VYPR
← All advisories
High severityNVD Advisory· Published Oct 12, 2023· Updated Feb 13, 2025

OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

CVE-2023-45142

Description

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.user_agent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses httpconv.ServerRequest that records every value for HTTP method and User-Agent. In order to be affected, a program has to use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label unknown non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

OpenTelemetry-Go Contrib's otelhttp handler records unbound cardinality for HTTP method and User-Agent, enabling memory exhaustion via crafted requests.

Vulnerability

Overview

CVE-2023-45142 describes a denial-of-service (DoS) vulnerability in the OpenTelemetry-Go Contrib library, specifically within the otelhttp.NewHandler wrapper. The handler automatically records the http.user_agent and http.method attributes without bounding their cardinality. This means every unique HTTP method or User-Agent string encountered creates a new metric label, leading to unbounded memory growth over time. The root cause is the internal use of httpconv.ServerRequest, which records every distinct value for these fields [1][4].

Attack

Vector and Prerequisites

An attacker can exploit this weakness by sending a large volume of crafted HTTP requests with random, long User-Agent headers or non-standard HTTP methods. Since there is no validation or normalization upstream, each unique value is stored as a new metric label, exhausting server memory. The affected application must use otelhttp.NewHandler and must not filter unknown HTTP methods or User-Agents at a CDN, load balancer, or earlier middleware layer [1][4].

Impact

A successful attack causes uncontrolled memory consumption, leading to server instability or crash. This is a classic high-cardinality metric DoS similar to previously reported vulnerabilities in OpenTelemetry and Prometheus client libraries [4]. The impact is limited to memory exhaustion; no data corruption or privilege escalation is described.

Mitigations

Version 0.44.0 of the library fixes the issue by restricting http.request.method to a well-known set of HTTP methods and removing other high-cardinality attributes. As a workaround, administrators can use otelhttp.WithFilter() to selectively filter requests, though this requires careful manual configuration. The recommended best practice is to upgrade to version 0.44.0 or later [1][4].

References
  1. NVD - CVE-2023-45142
  2. DoS vulnerability in otelhttp (uncontrolled resource consumption) due to unbound cardinality metrics

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpGo
< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestfulGo
< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelginGo
< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmuxGo
< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelechoGo
< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaronGo
< 0.44.00.44.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptraceGo
< 0.44.00.44.0

Affected products

387

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

12

News mentions

0

No linked articles in our index yet.