Opentelemetry Dotnet Contrib
Monthly
Unbounded HTTP response body allocation in OpenTelemetry.Sampler.AWS allows an attacker who controls the configured X-Ray sampling endpoint or who holds a network MitM position to exhaust heap memory and crash the consuming .NET process via OutOfMemoryException. Both NuGet packages OpenTelemetry.Sampler.AWS (versions below 0.1.0-alpha.8) and OpenTelemetry.Resources.AWS (versions below 1.15.1) are affected, with AWSXRaySamplerClient.DoRequestAsync calling ReadAsStringAsync() with no response size cap. No public exploit has been identified and EPSS sits at 0.01% (2nd percentile), consistent with SSVC exploitation status of none and CISA KEV absence, making this a low-urgency but patchable DoS risk.
Unbounded HTTP response body allocation in OpenTelemetry.Sampler.AWS allows an attacker who controls the configured X-Ray sampling endpoint or who holds a network MitM position to exhaust heap memory and crash the consuming .NET process via OutOfMemoryException. Both NuGet packages OpenTelemetry.Sampler.AWS (versions below 0.1.0-alpha.8) and OpenTelemetry.Resources.AWS (versions below 1.15.1) are affected, with AWSXRaySamplerClient.DoRequestAsync calling ReadAsStringAsync() with no response size cap. No public exploit has been identified and EPSS sits at 0.01% (2nd percentile), consistent with SSVC exploitation status of none and CISA KEV absence, making this a low-urgency but patchable DoS risk.