https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:04:23 +0000 https://cve.radiocsirt.org/vuln/ghsa-8pgv-569h-w5rw <p><strong>Affected:</strong> Go: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</p> <p>### Summary</p> <p>The grpc Unary Server Interceptor [opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327)</p> <p>``` // UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable // for use in a grpc.NewServer call. func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor { ``` out of the box adds labels</p> <p>- `net.peer.sock.addr` - `net.peer.sock.port`</p> <p>that have unbound cardinality. It leads to the server&#39;s potential memory exhaustion when many malicious requests are sent.</p> <p>### Details</p> <p>An attacker can easily flood the peer address and port for requests.</p> <p>### PoC</p> <p>Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it. ### Impact</p> <p>In order to be affected, the program has to configure a metrics pipeline, use [UnaryServerInterceptor](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327), and does not filter any client IP address and ports via middleware or proxies, etc.</p> <p>### Others</p> <p>It is similar to already reported vulnerabilities.</p> <p>* [GHSA-rcjv-mgp8-qvmr](https://github.com/open-telemetry/opentelemetry-go-…</p> <p><strong>Affected:</strong> Go: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc</p> <p>### Summary</p> <p>The grpc Unary Server Interceptor [opentelemetry-go-contrib/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327)</p> <p>``` // UnaryServerInterceptor returns a grpc.UnaryServerInterceptor suitable // for use in a grpc.NewServer call. func UnaryServerInterceptor(opts ...Option) grpc.UnaryServerInterceptor { ``` out of the box adds labels</p> <p>- `net.peer.sock.addr` - `net.peer.sock.port`</p> <p>that have unbound cardinality. It leads to the server&#39;s potential memory exhaustion when many malicious requests are sent.</p> <p>### Details</p> <p>An attacker can easily flood the peer address and port for requests.</p> <p>### PoC</p> <p>Apply the attached patch to the example and run the client multiple times. Observe how each request will create a unique histogram and how the memory consumption increases during it. ### Impact</p> <p>In order to be affected, the program has to configure a metrics pipeline, use [UnaryServerInterceptor](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327), and does not filter any client IP address and ports via middleware or proxies, etc.</p> <p>### Others</p> <p>It is similar to already reported vulnerabilities.</p> <p>* [GHSA-rcjv-mgp8-qvmr](https://github.com/open-telemetry/opentelemetry-go-…</p> https://cve.radiocsirt.org/vuln/ghsa-8pgv-569h-w5rw