opentelemetry-cpp EUVD-2026-36466

Exploitation requires that the OTLP HTTP exporter (for traces, metrics, or logs) be configured to send data to a collector endpoint the attacker can influence. Two distinct preconditions enable this: (1) the configured collector endpoint is directly attacker-controlled - for example, an exporter misconfigured to point to an attacker's server, or a legitimate collector that has been compromised; or (2) the attacker occupies a network position allowing MITM interception of the unencrypted (or improperly TLS-validated) exporter-to-collector HTTP connection. Exploitation is limited to the availability impact of the instrumented process - no credential theft or data exfiltration is possible via this vector. Deployments using mTLS with certificate pinning between exporter and collector, or those running in isolated network segments where MITM is not feasible and the collector is trusted infrastructure, are not realistically exploitable. The vulnerability does NOT affect OTLP gRPC exporters or file-based exporters - only the HTTP transport path is affected.

The CVSS base score of 5.3 (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a constrained attack surface: the adjacent-network vector and high complexity acknowledge that the attacker must either occupy a MITM position on the exporter's network segment or have already achieved control over the collector endpoint. The availability-only impact (A:H, C:N, I:N) is accurate - this is a targeted DoS with no lateral data exposure. EPSS at 0.02% confirms no current widespread exploitation tooling. The vulnerability is not in CISA KEV. However, the risk in specific deployment contexts is higher than the raw score implies: organizations exporting telemetry to third-party SaaS collectors, multi-tenant collector infrastructure, or over untrusted network segments face a realistic threat model. A compromised or rogue collector can crash any connected instrumented service repeatedly, making this an availability concern for observability pipelines in adversarial environments. The 'Information Disclosure' tag in the input data is inconsistent with the description and CVSS impact metrics - this is a DoS vulnerability, not an information disclosure issue; that tag should be treated as erroneous.

An attacker with control over the OTLP collector endpoint - achieved through supply-chain compromise of a shared collector, DNS/ARP poisoning on an internal network, or misconfiguration pointing the exporter at an attacker-owned host - returns an HTTP response with a multi-gigabyte body to any export request (traces, metrics, or logs). The instrumented C++ process allocates the full response into heap memory without bound, triggering an OOM kill or process crash, disrupting the service and eliminating its telemetry pipeline simultaneously. No public exploit code has been identified at time of analysis.