Executive brief
OpenTelemetry.Resources.Azure is a .NET library used to automatically detect and collect metadata about applications running in Azure environments. A vulnerability in how it handles data from the Azure metadata service allows an attacker to crash the application by sending an excessively large response. This can lead to service outages, process termination, or significant performance degradation due to memory exhaustion.
Technical details
The AzureVmMetaDataRequestor class in OpenTelemetry.Resources.Azure (versions 1.15.0-beta.1 and earlier) performs HTTP requests to the Azure VM instance metadata service (IMDS) and reads the entire response body into memory without a size limit. An attacker who can control the metadata endpoint or perform a Man-in-the-Middle (MitM) attack can provide an arbitrarily large response. This results in unbounded heap allocation, leading to high memory pressure, garbage collection stalls, or an OutOfMemoryException (OOM) that crashes the process. The issue is fixed in version 1.15.1-beta.1 (and 1.15.0-beta.2) by implementing response streaming and enforcing a 4 MiB limit on responses.
Affected products
- OpenTelemetry OpenTelemetry.Resources.Azure <= 1.15.0-beta.1
Timeline
- 2026-04-16: patched: Fix merged in pull request #4121
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-06: disclosed: CVE-2026-41483 published to NVD