CVE-2023-43810 json
opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics
published 2023-10-02 3 y ago modified 2026-09-10 1 mo ago also GHSA-5rv5-6h4r-h22v , PYSEC-2026-1752 , EUVD-2023-2660
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 58%
- public exploits
- 0
- none known
Summary
OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label `http_method` that has unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. HTTP method for requests can be easily set by an attacker to be random and long. In order to be affected program has to be instrumented for HTTP handlers and does not filter any unknown HTTP methods on the level of CDN, LB, previous middleware, etc. This issue has been patched in version 0.41b0.
Patch / fix
- pypi opentelemetry-instrumentation 0.41b0
- opentelemetry opentelemetry 0.41b0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.84% chance of exploitation in the next 30 days, higher than 58% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | opentelemetry-instrumentation | <0.41b0 |
0.41b0 |
Affected products
- open-telemetry opentelemetry-python-contrib
Classification
- Weakness
-
- CWE-400 Uncontrolled Resource Consumption
References
-
github.com
/open-telemetry/opentelemetry-python-contrib/commit/6007e0c013071e7f8b9612d3bc68aeb9d600d74e
web, patch
-
github.com
/open-telemetry/opentelemetry-python-contrib/security/advisories/GHSA-5rv5-6h4r-h22v
web, vendor-advisory
-
github.com
/open-telemetry/opentelemetry-python-contrib/releases/tag/v0.41b0
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-43810
advisory
-
github.com
/open-telemetry/opentelemetry-python-contrib
package
-
pypi.org
/project/opentelemetry-instrumentation
package
-
github.com
/advisories/GHSA-5rv5-6h4r-h22v
advisory
Sources
- CVE List CVE-2023-43810
- GitHub Advisory GHSA-5rv5-6h4r-h22v
- NVD CVE-2023-43810
- OSV PYSEC-2026-1752
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.