CVE-2024-36129 - CVE House

Back to Database

Status published High CVE-2024-36129

OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

8.2 CVSS

Vulnerability Description

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-36129

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from open-telemetry

View All →

OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package

OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability

open-telemetry has an Observable Timing Discrepancy

Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

Affected Vendor

open-telemetry

View all reports →

Affected Software

opentelemetry-collector

Vulnerable Versions:

< 0.102.1

Timeline

Official Publish: June 5th, 2024

Last Modified: August 2nd, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1203 Exploitation for Client Execution

T1055 Process Injection

Defense Evasion

T1105 Ingress Tool Transfer

Command and Control