Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.1 · CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

EPSS

• CVE-2024-32028: 0.29% estimated exploitation activity in the next 30 days; percentile 22.02 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact OpenTelemetry.Instrumentation.Http writes the url.full attribute/tag on spans (Activity) when tracing is enabled for outgoing http requests and OpenTelemetry.Instrumentation.AspNetCore writes the url.query attribute/tag on spans (Activity) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until the 1.8.1 the values written by OpenTelemetry.Instrumentation.Http & OpenTelemetry.Instrumentation.AspNetCore will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of OpenTelemetry.Instrumentation.Http & OpenTelemetry.Instrumentation.AspNetCore may use different tag names but have the same vulnerability. Resolution The…

Published by the source

12 Apr 2024, 22:54 UTC

Last modified by the source

17 Apr 2024, 21:43 UTC

Source last checked

26 Oct 2026, 17:00 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-vh2m-22xx-q94f

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-32028

Advisory: Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore
IDs: CVE-2024-32028, GHSA-vh2m-22xx-q94f
Record: https://patchnext.com/advisories/cve-2024-32028 (revision 1, source checked 26 Oct 2026, 17:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: opentelemetry.instrumentation.aspnetcore 1.8.1; opentelemetry.instrumentation.http 1.8.1. A vendor fix does not mean a deployment is fixed.

## Affected components
- NuGet opentelemetry.instrumentation.aspnetcore: affected < 1.8.1; fixed in 1.8.1
- NuGet opentelemetry.instrumentation.http: affected < 1.8.1; fixed in 1.8.1

## Suggested inspection (read-only)
- NuGet opentelemetry.instrumentation.aspnetcore: check the installed version with your package manager.
- NuGet opentelemetry.instrumentation.http: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on opentelemetry.instrumentation.aspnetcore, opentelemetry.instrumentation.http.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-vh2m-22xx-q94f (GitHub-reviewed advisory GHSA-vh2m-22xx-q94f lists affected ranges: NuGet opentelemetry.instrumentation.http >=0 =0 <1.8.1)

Commands are suggestions: review each one before running it.