AIKIDO-2026-849361
opentelemetry-http is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
opentelemetry-httpTL;DR
The reqwest, reqwest-blocking, and Hyper HttpClient implementations in opentelemetry-http read the full HTTP response body into memory with no size limit before returning it to callers such as OTLP exporters and the Jaeger remote sampler. An oversized response from the configured collector or sampling endpoint drives unbounded memory allocation, and the Hyper client's body read sits outside the configured request timeout, so a stalled response hangs the client indefinitely. The fix caps collected response bodies at 4 MiB with a ResponseBodyTooLarge error and moves the Hyper body read inside the existing timeout.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the built-in reqwest, reqwest-blocking, or hyper HTTP client implementations rather than a custom HttpClient.
Background info
opentelemetry-http is vulnerable to Denial of Service (DoS) in versions 0.3.0 - 0.32.0.
How to fix this
Upgrade the opentelemetry-http library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.