https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:36:15 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-05114 bdu:2024-05114 https://cve.radiocsirt.org/vuln/bdu:2024-05114 https://cve.radiocsirt.org/vuln/certfr-2024-avi-1061 certfr-2024-avi-1061 https://cve.radiocsirt.org/vuln/certfr-2024-avi-1061 https://cve.radiocsirt.org/vuln/euvd-2026-5661 EUVD-2026-5661 https://cve.radiocsirt.org/vuln/euvd-2026-5661 https://cve.radiocsirt.org/vuln/fkie_cve-2024-36129 <p>The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.</p> <p>The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-36129 https://cve.radiocsirt.org/vuln/ghsa-c74f-6mfw-mm4v <p><strong>Affected:</strong> Go: go.opentelemetry.io/collector/config/confighttp, Go: go.opentelemetry.io/collector/config/configgrpc</p> <p>### Summary An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption.</p> <p>### Details The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing subsequent handlers to process decompressed data. It supports the gzip, zstd, zlib, snappy, and deflate compression algorithms. A &#34;zip bomb&#34; or &#34;decompression bomb&#34; is a malicious archive designed to crash or disable the system reading it. Decompression of HTTP requests is typically not enabled by default in popular server solutions due to associated security risks. A malicious attacker could leverage this weakness to crash the collector by sending a small request that, when uncompressed by the server, results in excessive memory consumption.</p> <p>During proof-of-concept (PoC) testing, all supported compression algorithms could be abused, with zstd causing the most significant impact. Compressing 10GB of all-zero data reduced it to 329KB. Sending an HTTP request with this compressed data instantly consumed all available server memory (the testing server had 32GB), leading to an out-of-memory (OOM) kill of the collector application instance.</p> <p>The root cause for this issue can be found in the following code path:</p> <p>**Affected File:** [https://github.com/open-telemetry/opentelemetry-collector/[...]confighttp/compression.go](https://github.com/open-telemetry/opentelemetry-collector/blo…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/collector/config/confighttp, Go: go.opentelemetry.io/collector/config/configgrpc</p> <p>### Summary An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption.</p> <p>### Details The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing subsequent handlers to process decompressed data. It supports the gzip, zstd, zlib, snappy, and deflate compression algorithms. A &#34;zip bomb&#34; or &#34;decompression bomb&#34; is a malicious archive designed to crash or disable the system reading it. Decompression of HTTP requests is typically not enabled by default in popular server solutions due to associated security risks. A malicious attacker could leverage this weakness to crash the collector by sending a small request that, when uncompressed by the server, results in excessive memory consumption.</p> <p>During proof-of-concept (PoC) testing, all supported compression algorithms could be abused, with zstd causing the most significant impact. Compressing 10GB of all-zero data reduced it to 329KB. Sending an HTTP request with this compressed data instantly consumed all available server memory (the testing server had 32GB), leading to an out-of-memory (OOM) kill of the collector application instance.</p> <p>The root cause for this issue can be found in the following code path:</p> <p>**Affected File:** [https://github.com/open-telemetry/opentelemetry-collector/[...]confighttp/compression.go](https://github.com/open-telemetry/opentelemetry-collector/blo…</p> https://cve.radiocsirt.org/vuln/ghsa-c74f-6mfw-mm4v https://cve.radiocsirt.org/vuln/opensuse-su-2024:14439-1 <p>alloy-1.4.3-1.1 on GA media</p> <p>alloy-1.4.3-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:14439-1 https://cve.radiocsirt.org/vuln/rhsa-2024:3943 <p>opentelemetry-collector: denial of service via specially crafted HTTP or gRPC request</p> <p>opentelemetry-collector: denial of service via specially crafted HTTP or gRPC request</p> https://cve.radiocsirt.org/vuln/rhsa-2024:3943 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1392 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1392