CVE-2026-44967
Opentelemetry ≤ 1.27.0
Raw vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-44967 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Opentelemetry Opentelemetry. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-36466
Vulnerability Data
OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured…
more
collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unbounded HTTP response buffering in OTLP exporter directly enables application-layer memory exhaustion DoS when attacker controls the endpoint (CWE-789).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of input size and structure before allocating memory for the HTTP response body, directly blocking the unbounded vector allocation.
Mandates denial-of-service protection mechanisms that limit resource consumption from untrusted remote responses, mitigating memory exhaustion.
Enforces boundary protection and endpoint allow-listing, reducing the chance an attacker-controlled collector or MITM can supply an oversized response.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block excessive allocation flaws before deployment.
Secure development lifecycle includes input validation and size checks that prevent unbounded allocations.
Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.
Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.
Secure coding standards directly prohibit allocating memory from untrusted size values without validation.
Capacity management monitors overall resource use but does not prevent individual allocation bugs.