Executive brief
OpenTelemetry.Exporter.OneCollector is a software component used by .NET applications to send monitoring data to a central server. A vulnerability in how it handles error messages from that server allows a malicious or compromised server to crash the application by sending an excessively large response. This can lead to a denial-of-service condition where the application runs out of memory and stops functioning.
Technical details
The vulnerability exists in the HttpJsonPostTransport class of the OpenTelemetry.Exporter.OneCollector library. When the exporter receives an HTTP 4xx or 5xx error response from a configured backend, it attempts to read the entire response body into memory for logging purposes without enforcing an upper bound on the byte count. An attacker who controls the backend endpoint or can perform a Man-in-the-Middle (MitM) attack can serve an arbitrarily large response, triggering unbounded heap allocation. This results in high memory pressure, garbage collection stalls, and eventually an OutOfMemoryException that terminates the process. The issue is fixed in version 1.15.1 by capping the response body read to 4 MiB.
Affected products
- OpenTelemetry OpenTelemetry.Exporter.OneCollector <= 1.15.0
Timeline
- 2026-04-16: patched: Fix merged in GitHub pull request #4117
- 2026-04-27: advisory: Vendor security advisory published via GitHub
- 2026-05-06: disclosed: CVE-2026-41484 published to NVD