CVE-2023-45142

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

• CWE-770

• https://github.com/advisories/GHSA-cg3q-j54f-5p7pThird Party Advisory
• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65Product
• https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277Issue Tracking
• https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0Release Notes
• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrhVendor Advisory
• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmrVendor Advisory
• https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223Product
• https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159Product
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD/
• https://github.com/advisories/GHSA-cg3q-j54f-5p7pThird Party Advisory
• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65Product
• https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277Issue Tracking
• https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0Release Notes
• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrhVendor Advisory
• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmrVendor Advisory
• https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223Product
• https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159Product
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD/

Published

Oct 12, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-45137XWiki Platform is a generic wiki platform offering runtime s…5.4
• CVE-2023-45138Change Request is an pplication allowing users to request ch…9.6
• CVE-2023-45139fontTools is a library for manipulating fonts, written in Py…7.5
• CVE-2023-4514The Mmm Simple File List WordPress plugin through 2.3 does n…5.4
• CVE-2023-45140The Bastion provides authentication, authorization, traceabi…4.6
• CVE-2023-45141Fiber is an express inspired web framework written in Go. A …8.8
• CVE-2023-45143Undici is an HTTP/1.1 client written from scratch for Node.j…3.5
• CVE-2023-45144com.xwiki.identity-oauth:identity-oauth-ui is a package to a…9.6
• CVE-2023-45145Redis is an in-memory database that persists on disk. On sta…3.6
• CVE-2023-45146XXL-RPC is a high performance, distributed RPC framework. Wi…10
• CVE-2023-45147Discourse is an open source community platform. In affected …3.1
• CVE-2023-45148Nextcloud is an open source home cloud server. When Memcache…4.3