Skip to content
Fencer Vulns
high 7.5

CVE-2023-45142 json

OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

published 2023-10-12 3 y ago modified 2026-09-10 1 mo ago also GHSA-rcjv-mgp8-qvmr , GO-2023-2113 , EUVD-2023-2802

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.6%
EPSS 1.6% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

Patch / fix

  • go go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp 0.44.0
  • go go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful 0.44.0
  • go go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin 0.44.0
  • go go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux 0.44.0
  • go go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho 0.44.0
  • go go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron 0.44.0
  • go go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace 0.44.0
  • opentelemetry opentelemetry 0.44.0
  • ceph ceph storage 5.3 2:16.2.10-266.el8cp
  • ceph ceph storage 5.3 2:16.2.10-266.el9cp
  • cephadm ceph storage 5.3 2:16.2.10-266.el8cp
  • cephadm ceph storage 5.3 2:16.2.10-266.el9cp
  • librbd1 ceph storage 5.3 2:16.2.10-266.el8cp
  • librbd1 ceph storage 5.3 2:16.2.10-266.el9cp
  • librgw2 ceph storage 5.3 2:16.2.10-266.el8cp
  • librgw2 ceph storage 5.3 2:16.2.10-266.el9cp

red hat advisories RHSA-2024:4118

  • docker Linux Micro 6.1 27.5.1_ce-slfo.1.1_1.1
  • docker Linux Micro 6.0 26.1.5_ce-1.1
  • containerd Linux Micro 6.0 1.7.21-1.1
  • docker SLES for SAP 15 SP4, SLES for SAP 15 SP3, SLES for SAP 15 SP2 +18 more 26.1.5_ce-150000.212.1
  • golang-github-prometheus-prometheus SLE Module for Package Hub 15 SP6, SLE Module for Package Hub 15 SP5, openSUSE Leap 15.6 +2 more 2.45.6-150100.4.20.1
  • rhnlib Manager Client Tools 15 5.0.4-150000.3.46.1
  • spacecmd openSUSE Leap 15.6, openSUSE Leap 15.5, Manager Client Tools 15 5.0.9-150000.3.124.1
  • uyuni-tools Manager Client Tools for SLE Micro 5, Manager Client Tools 15 0.1.21-150000.1.8.2

suse advisories SUSE-SU-2025:20259-1SUSE-SU-2025:20110-1SUSE-SU-2025:20091-1SUSE-SU-2024:4360-1SUSE-SU-2024:4319-1SUSE-SU-2024:3288-1

  • containerd openSUSE Tumbleweed 1.7.21-1.1
  • docker openSUSE Tumbleweed 26.1.5_ce-2.1
  • golang-github-prometheus-prometheus openSUSE Tumbleweed 2.53.0-3.1
  • caddy Package Hub 15 SP6, openSUSE Leap 15.6 2.8.4-bp156.3.3.1
  • caddy Package Hub 15 SP5, openSUSE Leap 15.5 2.8.4-bp155.2.3.1
  • teleport openSUSE Tumbleweed 14.1.1-1.1
  • caddy openSUSE Tumbleweed 2.7.6-1.1

opensuse advisories openSUSE-SU-2024:14320-1openSUSE-SU-2024:14321-1openSUSE-SU-2024:14232-1openSUSE-SU-2024:0220-1openSUSE-SU-2024:0211-1openSUSE-SU-2024:13360-1

  • k3s Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 1.29.3.1-r0

alpine advisories ALPINE-CVE-2023-45142

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cri-tools CBL-Mariner 2.0 1.29.0-2
  • moby-compose CBL-Mariner 2.0 2.17.3-7
  • opa CBL-Mariner 2.0, Azure Linux 3.0 0.63.0-1
  • cert-manager Azure Linux 3.0 1.12.12-1
  • kube-vip-cloud-provider Azure Linux 3.0 0.0.10-1
  • kubernetes Azure Linux 3.0 1.29.1-2
  • prometheus Azure Linux 3.0 2.45.4-1
  • prometheus-adapter Azure Linux 3.0 0.12.0-1

azure linux advisories AZL-31303AZL-33347AZL-33516AZL-34580AZL-34889AZL-34900

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-45142 updated cvss 7.5

opentelemetry: DoS vulnerability in otelhttp

  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-acmesolver-rhel9
    affected: workaround, no fix available
  • Red Hat Logical Volume Manager Storage lvms4/lvms-rhel9-operator, lvms4/lvms-must-gather-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift API for Data Protection oadp/oadp-velero-plugin-for-aws-rhel8, oadp/oadp-velero-plugin-for-gcp-rhel9, oadp/oadp-volume-snapshot-mover-rhel8, oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-velero-plugin-for-microsoft-azure-rhel8 Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-operator-rhel8 Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-operator-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat 3scale API Management Platform 2 3scale-amp2/apicast-rhel7-operator, 3scale-amp2/3scale-apicast-operator-bundle Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/submariner-rhel8-operator
    affected: workaround, no fix available
  • Red Hat Certification for Red Hat Enterprise Linux 8 redhat-certification-cnf, redhat-certification-preflight Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf, redhat-certification-preflight
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift4/ose-pod, openshift-hyperkube, openshift4/ose-tests, +60 more
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Openshift Data Foundation 4 odf4/odf-multicluster-rhel9-operator
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Data Science (RHODS) odh-mcad-controller-container, rhods/odh-model-controller-rhel8, rhods/odh-ml-pipelines-cache-rhel8, rhods/odh-notebook-controller-rhel8, rhods/odh-kf-notebook-controller-rhel8, rhods/odh-ml-pipelines-api-server-rhel8, +6 more Red Hat OpenShift distributed tracing 2 rhosdt/tempo-rhel8, rhosdt/tempo-query-rhel8, rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-query-rhel8, rhosdt/tempo-gateway-rhel8, rhosdt/jaeger-ingester-rhel8, +5 more
    affected: workaround, no fix available
show 15 more
  • Red Hat OpenShift GitOps openshift-gitops-1/kam-delivery-rhel8, openshift-gitops-1/argocd-extensions-rhel8
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Openshift Sandboxed Containers openshift-sandboxed-containers/osc-rhel8-operator, openshift-sandboxed-containers/osc-must-gather-rhel8 Red Hat OpenShift Virtualization 4 container-native-virtualization/cluster-network-addons-operator, container-native-virtualization/cluster-network-addons-operator-rhel9 Red Hat Quay 3 quay/clair-rhel8
    affected: workaround, no fix available
  • Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-validation-rhel9 2.5.3-12
    fixed: vendor fix RHBA-2023:7648
  • Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.0-50, oadp/oadp-rhel9-operator 1.3.1-40, oadp/oadp-mustgather-rhel9 1.3.0-138, oadp/oadp-velero-plugin-for-csi-rhel9 1.3.0-34, oadp/oadp-velero-restic-restore-helper-rhel9 1.3.0-45
    fixed: vendor fix RHSA-2023:7555
  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8 v2.9.3-9
    fixed: vendor fix RHSA-2024:1328
  • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/thanos-rhel9 v2.10.5-6, rhacm2/console-rhel9 v2.10.5-8, rhacm2/memcached-rhel9 v2.10.5-3, rhacm2/prometheus-rhel9 v2.10.5-6, rhacm2/acm-grafana-rhel9 v2.10.5-5, rhacm2/acm-search-v2-rhel9 v2.10.5-5, +38 more
    fixed: vendor fix RHSA-2024:6236
  • Red Hat Ceph Storage 5.3 MON ceph 16.2.10-266.el8cp, cephadm 16.2.10-266.el8cp, librbd1 16.2.10-266.el8cp, librgw2 16.2.10-266.el8cp, ceph-mgr 16.2.10-266.el8cp, ceph-mon 16.2.10-266.el8cp, +22 more Red Hat Ceph Storage 5.3 OSD ceph 16.2.10-266.el8cp, librbd1 16.2.10-266.el8cp, librgw2 16.2.10-266.el8cp, ceph-osd 16.2.10-266.el8cp, ceph-base 16.2.10-266.el8cp, ceph-test 16.2.10-266.el8cp, +12 more Red Hat Ceph Storage 5.3 Tools ceph 16.2.10-266.el8cp, ceph 16.2.10-266.el9cp, cephadm 16.2.10-266.el8cp, cephadm 16.2.10-266.el9cp, librbd1 16.2.10-266.el8cp, librbd1 16.2.10-266.el9cp, +44 more
    fixed: vendor fix RHSA-2024:4118
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-thanos-rhel8 v4.12.0-202402081808.p0.g2867a6b.assembly.stream.el8
    fixed: vendor fix RHSA-2024:0833
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-thanos-rhel8 v4.13.0-202401292134.p0.g70fb57f.assembly.stream, openshift4/ose-cluster-openshift-controller-manager-operator v4.13.0-202409131306.p0.g6e7e783.assembly.stream.el8
    fixed: vendor fix RHSA-2024:6811
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-telemeter v4.14.0-202312132033.p0.gc683f65.assembly.stream, openshift4/ose-prometheus v4.14.0-202312051151.p0.gb7c61bc.assembly.stream, openshift4/ose-thanos-rhel8 v4.14.0-202311211133.p0.ga267125.assembly.stream, openshift4/ose-cluster-api-rhel8 v4.14.0-202401292111.p0.gae83c55.assembly.stream, openshift4/ose-operator-registry v4.14.0-202312132033.p0.g3bb41f0.assembly.stream, openshift4/ose-node-feature-discovery v4.14.0-202312052033.p0.gaa5c125.assembly.stream, +12 more
    fixed: vendor fix RHSA-2024:0642
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-prometheus v4.15.0-202401290854.p0.g6828e44.assembly.stream, openshift4/ose-thanos-rhel8 v4.15.0-202402082307.p0.g66161ad.assembly.stream.el8, openshift4/ose-telemeter-rhel9 v4.15.0-202402201438.p0.g80992e5.assembly.stream.el9, openshift4/ose-vsphere-csi-driver-rhel9 v4.15.0-202401261531.p0.g74481e3.assembly.stream, openshift4/ose-multus-networkpolicy-rhel9 v4.15.0-202401261531.p0.g6212406.assembly.stream, openshift4/ose-azure-disk-csi-driver-rhel9 v4.15.0-202401261531.p0.gdcb7e1c.assembly.stream, +34 more
    fixed: vendor fix RHSA-2024:8991
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-insights-rhel9-operator v4.16.0-202406131906.p0.g3c7446c.assembly.stream.el9, openshift4/ose-aws-ebs-csi-driver-rhel9 v4.16.0-202406131906.p0.g1d29a74.assembly.stream.el9, openshift4/ose-vsphere-csi-driver-rhel9 v4.16.0-202406131906.p0.g3cd689f.assembly.stream.el9, openshift4/ose-cluster-olm-rhel9-operator v4.16.0-202406131906.p0.g27bf70d.assembly.stream.el9, openshift4/ose-azure-disk-csi-driver-rhel9 v4.16.0-202406131906.p0.g6b55f6f.assembly.stream.el9, openshift4/ose-azure-file-csi-driver-rhel9 v4.16.0-202406131906.p0.g5ceb190.assembly.stream.el9, +10 more
    fixed: vendor fix RHSA-2024:0041
  • Red Hat OpenShift Container Platform 4.17 openshift4/ose-operator-sdk-rhel9 v4.17.0-202410081406.p0.g3a3708d.assembly.stream.el9, openshift4/ose-helm-rhel9-operator v4.17.0-202410081406.p0.g3a3708d.assembly.stream.el9, openshift4/ose-ansible-rhel9-operator v4.17.0-202410080934.p0.g1d4d62e.assembly.stream.el9
    fixed: vendor fix RHSA-2024:7921
  • Red Hat OpenShift distributed tracing 3.0 rhosdt/tempo-rhel8 2.3.0-2, rhosdt/tempo-query-rhel8 0.6.0-3, rhosdt/jaeger-agent-rhel8 1.51.0-1, rhosdt/jaeger-query-rhel8 1.51.0-1, rhosdt/tempo-gateway-rhel8 0.1.2-19, rhosdt/jaeger-ingester-rhel8 1.51.0-1, +5 more
    fixed: vendor fix RHSA-2023:7663
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/lokistack-gateway-rhel8 Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9 Red Hat Migration Toolkit for Virtualization 2.5 migration-toolkit-virtualization/mtv-api-rhel9 2.5.3-11, migration-toolkit-virtualization/mtv-rhel8-operator 2.5.3-11, migration-toolkit-virtualization/mtv-virt-v2v-rhel9 2.5.3-10, migration-toolkit-virtualization/mtv-operator-bundle 2.5.3-30, migration-toolkit-virtualization/mtv-controller-rhel9 2.5.3-11, migration-toolkit-virtualization/mtv-must-gather-rhel8 2.5.3-9, +7 more Red Hat OpenShift API for Data Protection oadp/oadp-velero-plugin-rhel8 Red Hat OpenShift API for Data Protection 1.3 oadp/oadp-velero-rhel9 1.3.1-16, oadp/oadp-rhel9-operator 1.3.0-97, oadp/oadp-operator-bundle 1.3.1-59, oadp/oadp-mustgather-rhel9 1.3.1-53, oadp/oadp-operator-bundle 1.3.0-156, oadp/oadp-velero-plugin-rhel9 1.3.0-32, +11 more
    +3 more products
    Red Hat OpenShift Serverless openshift-gitops-1/gitops-rhel8-operator, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/kourier-control-rhel8, openshift-serverless-1/kn-serving-queue-rhel9, openshift-serverless-1/net-istio-webhook-rhel9, openshift-serverless-1/kn-eventing-mtping-rhel9, +20 more Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/thanos-rhel8 v2.9.3-5, rhacm2/console-rhel8 v2.9.3-11, rhacm2/memcached-rhel8 v2.9.3-3, rhacm2/prometheus-rhel8 v2.9.3-5, rhacm2/acm-grafana-rhel8 v2.9.3-5, rhacm2/acm-search-v2-rhel8 v2.9.3-7, +37 more Red Hat OpenShift Container Platform 4 cri-tools, microshift, microshift-olm, microshift-sriov, microshift-multus, microshift-selinux, +37 more
    not affected: vulnerable code not present

9 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.61% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
<0.44.0
0.44.0
go go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful
<0.44.0
0.44.0
go go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin
<0.44.0
0.44.0
go go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux
<0.44.0
0.44.0
go go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho
<0.44.0
0.44.0
go go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron
<0.44.0
0.44.0
go go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
<0.44.0
0.44.0

Affected products

  • open-telemetry opentelemetry-go-contrib

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.