CVE-2026-44967

Name of the Vulnerable Software and Affected Versions OpenTelemetry-cpp versions prior to 1.27.0

Description The OTLP HTTP exporters for traces, metrics, and logs read the complete HTTP response into an in-memory vector of bytes without implementing a size limit. This can lead to memory exhaustion if the configured collector endpoint is controlled by an attacker or if a network attacker performs a Man-in-the-Middle (MITM) attack on the exporter connection.

Recommendations Update to version 1.27.0.