Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics #5089

Closed
Tracked by #5207
zroubalik opened this issue Oct 16, 2023 · 0 comments · Fixed by #5088
Closed
Tracked by #5207

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics #5089

zroubalik opened this issue Oct 16, 2023 · 0 comments · Fixed by #5088
Assignees
@zroubalik
Labels
bug Something isn't working

Comments

@zroubalik
Copy link
Member

zroubalik commented Oct 16, 2023 •
edited
Loading

Report

GHSA-rcjv-mgp8-qvmr

OpenTelemetry-Go Contrib has a handler wrapper otelhttp that adds the following labels by deafult that have unbound cardinality:

http.user_agent
http.method

This leads to the server's potential memory exhaustion when many malicious requests are sent to it.
@zroubalik zroubalik added the bug Something isn't working label Oct 16, 2023
@zroubalik zroubalik self-assigned this Oct 16, 2023
@zroubalik zroubalik mentioned this issue Oct 16, 2023
Merged
2 tasks
@zroubalik zroubalik mentioned this issue Nov 27, 2023
Closed
16 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@zroubalik zroubalik

Labels
bug Something isn't working
Projects
Roadmap - KEDA Core
Archived in project
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

bump otel to v > 0.44.0 to fix CVE-2023-45142 zroubalik/keda
1 participant
@zroubalik