AIKIDO-2024-10561
opentelemetry-javaagent is vulnerable to Improper Resource Shutdown or Release
18
Low Risk
This Affects:
opentelemetry-javaagentTL;DR
Affected versions of this package fail to properly release resources in the getPom and includeEmbeddedExtensionsIfFound methods, resulting in memory leaks. Repeated execution of these methods can cause unbounded memory growth, eventually exhausting available resources and leading to Denial of Service (DoS). This vulnerability may be exploited by attackers to degrade system performance or crash the application by triggering the affected code paths multiple times.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you are using the JarDetails.getPom() or the ExtensionClassLoader.getInstance() method.
Background info
opentelemetry-javaagent is vulnerable to Improper Resource Shutdown or Release in versions 1.3.0 - 2.10.0.
How to fix this
Upgrade the io.opentelemetry.javaagent:opentelemetry-javaagent library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant