Skip to content
Fencer Vulns
high 7.5

CVE-2023-47108 json

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

published 2023-11-10 2 y ago modified 2026-09-10 1 mo ago also GHSA-8pgv-569h-w5rw , GO-2023-2331 , EUVD-2023-2927

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.0%
EPSS 2.0% chance of exploitation in 30 days, percentile 81%
public exploits
0
none known

Summary

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

Patch / fix

  • go go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc 0.46.0
  • opentelemetry opentelemetry 0.46.0
  • cri-o openshift 4.12 1.25.5-6.rhaos4.12.gitfcf6ef3.el8
  • cri-o openshift 4.13 1.26.4-9.1.rhaos4.13.gite26e057.el8
  • cri-o openshift 4.13 1.26.4-9.1.rhaos4.13.gite26e057.el9
  • cri-o openshift 4.14 1.27.2-7.rhaos4.14.git1cc7a64.el8
  • cri-o openshift 4.14 1.27.2-7.rhaos4.14.git1cc7a64.el9

red hat advisories RHSA-2024:0489RHSA-2024:0288RHSA-2024:0207

  • docker-compose Linux Micro 6.0 2.33.1-1.1
  • docker Linux Micro 6.1 27.5.1_ce-slfo.1.1_1.1
  • docker Linux Micro 6.0 26.1.5_ce-1.1
  • containerd Linux Micro 6.0 1.7.21-1.1
  • docker SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +18 more 26.1.5_ce-150000.212.1
  • etcd openSUSE Leap 15.6, openSUSE Leap 15.5 3.5.12-150000.7.6.1
  • containerd SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +18 more 1.7.21-150000.117.1
  • containerd SLE Module for Containers 12 1.7.21-16.94.1

suse advisories SUSE-SU-2025:20385-1SUSE-SU-2025:20259-1SUSE-SU-2025:20110-1SUSE-SU-2025:20091-1SUSE-SU-2024:4360-1SUSE-SU-2024:4319-1

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
  • etcd Package Hub 15 SP6, openSUSE Leap 15.6 3.5.12-bp156.4.3.1
  • containerd openSUSE Tumbleweed 1.7.21-1.1
  • docker openSUSE Tumbleweed 26.1.5_ce-2.1
  • etcd openSUSE Tumbleweed 3.5.11-1.1
  • etcd-for-k8s1.27 openSUSE Tumbleweed 3.5.12-1.1
  • etcd-for-k8s1.28 openSUSE Tumbleweed 3.5.12-1.1
  • etcd-for-k8s1.29 openSUSE Tumbleweed 3.5.12-1.1

opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2025:0003-1openSUSE-SU-2024:14320-1openSUSE-SU-2024:14321-1openSUSE-SU-2024:13615-1openSUSE-SU-2024:13834-1

  • moby-containerd-cc CBL-Mariner 2.0 1.7.2-3
  • containerd Azure Linux 3.0 1.7.13-3
  • kube-vip-cloud-provider Azure Linux 3.0 0.0.10-1
  • moby-containerd-cc Azure Linux 3.0 1.7.7-3
  • docker-buildx Azure Linux 3.0 0.14.0-1
  • docker-compose Azure Linux 3.0 2.27.0-1
  • ig Azure Linux 3.0 0.30.0-1

azure linux advisories AZL-31896AZL-34620AZL-34891AZL-34995AZL-35434AZL-35440

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-47108 updated cvss 7.5

opentelemetry-go-contrib: DoS vulnerability in otelgrpc due to unbound cardinality metrics

  • Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9, lvms4/lvms-rhel9-operator
    affected: workaround, no fix available, no fix planned “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/agent-service-rhel8 Red Hat Ceph Storage 7 rhceph/grafana-rhel9
    affected: workaround, no fix available “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +8 more
    affected: workaround, no fix planned “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
  • Red Hat Enterprise Linux 10 grafana
    affected: workaround, no fix available “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-sdn-rhel8, openshift4/ose-haproxy-router, openshift4/ose-console-operator, ose-haproxy-router-base-container, openshift4/ose-service-ca-operator, openshift4/ose-cluster-network-operator, +4 more
    affected: workaround, no fix available, no fix planned “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
  • Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel8, rhosdt/jaeger-agent-rhel8
    affected: workaround, no fix available “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
  • Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8
    affected: workaround, no fix planned “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator
    affected: workaround, no fix available “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.”
show 12 more
  • Red Hat multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-installer-rhel8 v2.6.4-7, multicluster-engine/assisted-service-8-rhel8 v2.6.4-11, multicluster-engine/assisted-image-service-rhel8 v2.6.4-4, multicluster-engine/assisted-installer-agent-rhel8 v2.6.4-7, multicluster-engine/assisted-installer-controller-rhel8 v2.6.4-6 Red Hat multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/hive-rhel9 v2.6.4-6, multicluster-engine/work-rhel9 v2.6.4-14, multicluster-engine/discovery-rhel9 v2.6.4-14, multicluster-engine/placement-rhel9 v2.6.4-14, multicluster-engine/cluster-api-rhel9 v2.6.4-4, multicluster-engine/console-mce-rhel9 v2.6.4-19, +24 more
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:11293
  • Red Hat multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8 v2.7.2-1 Red Hat multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/hive-rhel9 v2.7.2-1, multicluster-engine/work-rhel9 v2.7.2-1, multicluster-engine/discovery-rhel9 v2.7.2-1, multicluster-engine/placement-rhel9 v2.7.2-1, multicluster-engine/cluster-api-rhel9 v2.7.2-1, multicluster-engine/console-mce-rhel9 v2.7.2-1, +28 more
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:10857
  • Red Hat OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8 2.12.1-376, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8 2.12.1-376, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel8-operator 2.12.1-376, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle 2.12.1-376, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8 2.12.1-376
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:1812
  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8 v2.9.3-9
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:1328
  • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/thanos-rhel9 v2.10.5-6, rhacm2/console-rhel9 v2.10.5-8, rhacm2/memcached-rhel9 v2.10.5-3, rhacm2/prometheus-rhel9 v2.10.5-6, rhacm2/acm-grafana-rhel9 v2.10.5-5, rhacm2/acm-search-v2-rhel9 v2.10.5-5, +38 more
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:6236
  • Red Hat OpenShift Container Platform 4.12 cri-o 1.25.5-6.rhaos4.12.gitfcf6ef3.el8
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:0489
  • Red Hat OpenShift Container Platform 4.13 cri-o 1.26.4-9.1.rhaos4.13.gite26e057.el8, cri-o 1.26.4-9.1.rhaos4.13.gite26e057.el9, openshift4/ose-aws-cloud-controller-manager-rhel8 v4.13.0-202402070238.p0.gf116a0d.assembly.stream.el8, openshift4/ose-cluster-openshift-controller-manager-operator v4.13.0-202409131306.p0.g6e7e783.assembly.stream.el8
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:0288
  • Red Hat OpenShift Container Platform 4.14 cri-o 1.27.2-7.rhaos4.14.git1cc7a64.el8, cri-o 1.27.2-7.rhaos4.14.git1cc7a64.el9, openshift4/ose-operator-registry v4.14.0-202403191142.p0.gdcfcfb3.assembly.stream.el8, openshift4/ose-node-feature-discovery v4.14.0-202312052033.p0.gaa5c125.assembly.stream, openshift4/ose-clusterresourceoverride-rhel8 v4.14.0-202312060650.p0.g535611f.assembly.stream, openshift4/ose-powervs-block-csi-driver-rhel8 v4.14.0-202312082233.p0.g90e87d7.assembly.stream, +12 more
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:0207
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-ebs-csi-driver-rhel9 v4.15.0-202401261531.p0.gb692edb.assembly.stream, openshift4/ose-azure-disk-csi-driver-rhel9 v4.15.0-202401261531.p0.gdcb7e1c.assembly.stream, openshift4/ose-azure-file-csi-driver-rhel9 v4.15.0-202401261531.p0.g364d90d.assembly.stream, openshift4/ose-operator-registry-rhel9 v4.15.0-202403111911.p0.g59aa935.assembly.stream.el9, openshift4/ose-csi-external-provisioner v4.15.0-202402082307.p0.gce5a1a3.assembly.stream.el8, openshift4/ose-node-feature-discovery-rhel9 v4.15.0-202401311148.p0.ge4929ab.assembly.stream, +26 more
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2023:7198
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-insights-rhel9-operator v4.16.0-202406131906.p0.g3c7446c.assembly.stream.el9, openshift4/ose-aws-ebs-csi-driver-rhel9 v4.16.0-202406131906.p0.g1d29a74.assembly.stream.el9, openshift4/ose-azure-file-csi-driver-rhel9 v4.16.0-202406131906.p0.g5ceb190.assembly.stream.el9, openshift4/ose-cluster-storage-rhel9-operator v4.16.0-202406131906.p0.g7cb8267.assembly.stream.el9, openshift4/ose-csi-external-provisioner-rhel9 v4.16.0-202406131906.p0.g9e8af01.assembly.stream.el9, openshift4/ose-csi-node-driver-registrar-rhel9 v4.16.0-202406131906.p0.g8930c36.assembly.stream.el9, +15 more
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:0041
  • Red Hat RHODF 4.16 for RHEL 9 odf4/odf-csi-addons-sidecar-rhel9 v4.16.0-15
    fixed: vendor fix “As a workaround, use a view removing the attributes. Another possibility is to disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.” RHSA-2024:4591
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9 Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel8, oadp/oadp-rhel8-operator, oadp/oadp-velero-plugin-rhel8, oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-csi-rhel8, oadp/oadp-velero-plugin-for-gcp-rhel9, +2 more Red Hat OpenShift Pipelines openshift-pipelines-client Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-operator-rhel8 Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
    +12 more products
    Red Hat OpenShift Serverless openshift-gitops-1/gitops-rhel8-operator, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kn-serving-queue-rhel9, openshift-serverless-1/net-istio-webhook-rhel9, openshift-serverless-1/kn-eventing-mtping-rhel9, openshift-serverless-1/kn-plugin-event-sender-rhel9, +2 more Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/thanos-rhel8 v2.9.3-5, rhacm2/console-rhel8 v2.9.3-11, rhacm2/memcached-rhel8 v2.9.3-3, rhacm2/prometheus-rhel8 v2.9.3-5, rhacm2/acm-grafana-rhel8 v2.9.3-5, rhacm2/acm-search-v2-rhel8 v2.9.3-7, +37 more Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9 Red Hat Enterprise Linux 8 osbuild-composer, osbuild-composer-core, osbuild-composer-worker, osbuild-composer-dnf-json Red Hat Enterprise Linux 9 grafana, ignition, ignition-edge, ignition-grub, grafana-selinux, osbuild-composer, +4 more Red Hat Enterprise Linux 10 osbuild-composer Red Hat OpenShift Container Platform 4 cri-tools, openshift, microshift, microshift-olm, microshift-sriov, microshift-multus, +68 more Red Hat OpenShift Container Platform 4.12 podman 4.4.1-1.rhaos4.12.el8, podman-tests 4.4.1-1.rhaos4.12.el8, podman-docker 4.4.1-1.rhaos4.12.el8, podman-remote 4.4.1-1.rhaos4.12.el8, podman-gvproxy 4.4.1-1.rhaos4.12.el8, podman-plugins 4.4.1-1.rhaos4.12.el8, +5 more Red Hat OpenShift Container Platform 4.13 ovn23.06 23.06.1-82.el9fdp, rhcos 413.92.202402060605-0, rhcos 413.92.202409180051-0, ovn23.06-host 23.06.1-82.el9fdp, ovn23.06-vtep 23.06.1-82.el9fdp, ovn23.06-central 23.06.1-82.el9fdp, +211 more Red Hat OpenShift Container Platform 4.14 catch 3.5.1-1.el9, perf 5.14.0-284.48.1.el9_2, rtla 5.14.0-284.48.1.el9_2, rhcos 414.92.202312132152-0, rhcos 414.92.202401110948-0, rhcos 414.92.202402010350-0, +1569 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202402201450-0, rhcos 415.92.202403191241-0, rhcos 415.92.202404161628-0, rhcos 415.92.202405070140-0, rhcos 415.92.202405130844-0, rhcos 415.92.202409031652-0, +983 more
    not affected: vulnerable code not present

6 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

2.03% chance of exploitation in the next 30 days, higher than 81% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
>=0.37.0, <0.46.0
0.46.0

Affected products

  • open-telemetry opentelemetry-go-contrib

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.