Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

NuGet package

opentelemetry.resources.azure

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.9NuGetPublished

    OpenTelemetry.Resources.Azure has an unbounded HTTP response body read

    CVE-2026-41483 · GHSA-vc24-j8c5-2vw4

    Affected
    • NuGet opentelemetry.resources.azure <= 1.15.0-beta.1
    Fixed in
    1.15.1-beta.1· Vendor fix available
    Issue
    OpenTelemetry.Resources.Azure reads unbounded HTTP response bodies from the Azure VM remote instance metadata service endpoint into memory. This would allow an attacker-controlled endpoint or one acting as a Man-in-the-Middle (MitM) to cause excessive memory allocation and possible process termination (via Out of Memory (OOM)). Details The AzureVmMetaDataRequestor class makes HTTP requests to the relevant Azure VM instance metadata service (http://169.254.169.254) to obtain metadata about the running process and its infrastructure. An attacker who controls the configured endpoint, or who can intercept traffic to them (MiTM), can return an arbitrarily large response body. This causes unbounded heap allocation in the consuming process, leading to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the process. Impact Denial of Service (DoS). An attacker can destabilize or crash the application by forcing unbounded memory…

    Recommended action: Upgrade to 1.15.1-beta.1 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →