VULNERABILITY INTELLIGENCE
CVE-2024-36129
CVSS score8.2 HIGH
EPSS probability1.24%
CISA KEVNot currently listed
Published2024-06-05
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Description
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.
Weakness classification
- security-advisories@github.com: CWE-119
- nvd@nist.gov: CWE-119
Primary references
- security-advisories@github.com — Patch
- security-advisories@github.com — Patch
- security-advisories@github.com — Exploit, Third Party Advisory
- security-advisories@github.com — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Patch
- af854a3a-2127-422b-91ae-364da2661108 — Patch
- af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory