Skip to content
Fencer Vulns
high 7.5

CVE-2023-25151 json

DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib

published 2023-02-08 3 y ago modified 2026-06-17 4 mo ago also GHSA-5r5m-65gx-7vrh , GO-2023-1546 , EUVD-2023-0632

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not "forget" previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.

Patch / fix

  • go go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp 0.39.0
  • go go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego 0.39.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-25151 updated cvss 7.5

opentelemetry-go: DoS vulnerability for high cardinality metrics in otelhttp and otelbeego

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9 Red Hat Cryostat 2 cryostat-tech-preview/cryostat-rhel8-operator Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/opa-openshift-rhel8, openshift-logging/lokistack-gateway-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/cluster-logging-rhel8-operator Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-velero-rhel8, rhmtc/openshift-migration-velero-plugin-for-gcp-rhel8, rhmtc/openshift-migration-velero-plugin-for-microsoft-azure-rhel8 Red Hat Node Maintenance Operator workload-availability/node-maintenance-rhel8-operator
    +13 more products
    Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8, oadp/oadp-velero-plugin-for-gcp-rhel9, +3 more Red Hat OpenShift Developer Tools and Services ocp-tools-4/service-binding-rhel8-operator Red Hat OpenShift Serverless openshift-serverless-1/client-kn-rhel8, openshift-serverless-1/serving-queue-rhel8, openshift-serverless-1/eventing-mtping-rhel8, openshift-serverless-1/kourier-control-rhel8, openshift-serverless-1/ingress-rhel8-operator, openshift-serverless-1/net-istio-webhook-rhel8, +2 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/thanos-rhel7, rhacm2/volsync-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-prometheus-rhel8, rhacm2/multiclusterhub-rhel8, rhacm2/rbac-query-proxy-rhel8, +23 more Red Hat Advanced Cluster Security 3 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-scanner-rhel8 Red Hat OpenShift Container Platform 4 cri-tools, openshift, microshift, microshift-olm, microshift-sriov, microshift-multus, +183 more Red Hat Openshift Data Foundation 4 odf4/cephcsi-rhel9, odf4/odf-topolvm-rhel8, odf4/mcg-rhel9-operator, odf4/ocs-rhel9-operator, odf4/odf-rhel8-operator, odf4/odr-rhel9-operator, +3 more Red Hat OpenShift distributed tracing 2 rhosdt/opentelemetry-rhel8-operator, rhosdt/opentelemetry-collector-rhel8 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/applicationset-rhel8, openshift-gitops-1/gitops-rhel8-operator Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/kubernetes-nmstate-handler-rhel8, container-native-virtualization/cluster-network-addons-operator-rhel9 Red Hat OpenStack Platform 16.2 rhosp-rhel8/osp-director-agent Red Hat Quay 3 quay/clair-rhel8, quay/quay-operator-rhel8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
>=0.38.0, <0.39.0
0.39.0
go go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego
>=0.38.0, <0.39.0
0.39.0

Affected products

  • open-telemetry opentelemetry-go-contrib

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.