Vulnerability in OpenTelemetry.Resources.Azure (CVE-2026-41483)
Summary
Vulnerability in OpenTelemetry.Resources.Azure (CVE-2026-41483). Risk of unauthorized operations or information disclosure. Exploitable via OpenTelemetry.Resources.Azure. Mitigation: upgrade to 1.15.1-beta.1 or later.
Original description
The description as published by the source.
Summary
OpenTelemetry.Resources.Azure reads unbounded HTTP response bodies from the Azure VM remote instance metadata service endpoint into memory.
This would allow an attacker-controlled endpoint or one acting as a Man-in-the-Middle (MitM) to cause excessive memory allocation and possible process termination (via Out of Memory (OOM)).
Details
The AzureVmMetaDataRequestor class makes HTTP requests to the relevant Azure VM instance metadata service (http://169.254.169.254) to obtain metadata about the running process and its infrastructure.
An attacker who controls the configured endpoint, or who can intercept traffic to them (MiTM), can return an arbitrarily large response body. This causes unbounded heap allocation in the consuming process, leading to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the process.
Impact
Denial of Service (DoS). An attacker can destabilize or crash the application by forcing unbounded memory allocation through the Azure VM instance metadata HTTP response paths.
Mitigating Factors
The application's reachable Azure VM metadata endpoint needs to behave maliciously or be subject to MitM. In normal usage response bodies should not be excessively large.
Patches
Fixed in `OpenTelemetry.Res…
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-41483 has been found in OpenTelemetry.Resources.Azure.
Attackers can target a specific entry point like OpenTelemetry.Resources.Azure over the network to misuse the product.
Risk of unauthorized operations or information disclosure. CVSS score: 5.9/10.
What to do: upgrade OpenTelemetry.Resources.Azure to 1.15.1-beta.1 or later.
If unsure, ask your IT team or search "OpenTelemetry.Resources.Azure CVE-2026-41483" on the vendor's site.
CVE-2026-41483 (OpenTelemetry.Resources.Azure) — CWE-770 / CVSS v3 5.9
Attack vector: remote (network-reachable) / unauthenticated / no user interaction
Attack surface: OpenTelemetry.Resources.Azure / AzureVmMetaDataRequestor / OutOfMemoryException / HttpClient
Patched: 1.15.1-beta.1 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-770) exists in OpenTelemetry.Resources.Azure. Attackers reach the vulnerable code path via OpenTelemetry.Resources.Azure without authentication.
Check the vendor advisory for the affected versions of OpenTelemetry.Resources.Azure. Attack surface: OpenTelemetry.Resources.Azure / AzureVmMetaDataRequestor / OutOfMemoryException / HttpClient.
Severity: Medium (CVSS 5.9/10). Risk of unauthorized operations or information disclosure.
Update to 1.15.1-beta.1.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'OpenTelemetry.Resources.Azure' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'OpenTelemetry.Resources.Azure' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
OpenTelemetry.Resources.Azureを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade OpenTelemetry.Resources.Azure to 1.15.1-beta.1ステージング環境で 1.15.1-beta.1 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- package github.com
- patch security-advisories@github.com
- patch security-advisories@github.com
- web github.com
- web github.com