CVE-2023-47108

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

• CWE-770

• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327Product
• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138Product
• https://github.com/open-telemetry/opentelemetry-go-contrib/commit/04c5dcbb5b35f14b4e6793b245919c72addbc7d0
• https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333bPatch
• https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322Issue Tracking, Patch
• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rwVendor Advisory
• https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProviderProduct
• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327Product
• https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138Product
• https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333bPatch
• https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322Issue Tracking, Patch
• https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rwVendor Advisory
• https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProviderProduct

Published

Nov 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47101The installer (aka openvpn-client-installer) in Securepoint …7.8
• CVE-2023-47102UrBackup Server 2.5.31 allows brute-force enumeration of use…5.3
• CVE-2023-47104tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows…9.8
• CVE-2023-47105exec.CommandContext in Chaosblade 0.3 through 1.7.3, when se…8.6
• CVE-2023-47106Traefik is an open source HTTP reverse proxy and load balanc…6.5
• CVE-2023-47107PILOS is an open source front-end for BigBlueButton servers …8.8
• CVE-2023-47109PrestaShop blockreassurance adds an information block aimed …8.1
• CVE-2023-4711A vulnerability, which was classified as critical, has been …8.1
• CVE-2023-47110blockreassurance adds an information block aimed at offering…5.3
• CVE-2023-47111ZITADEL provides identity infrastructure. ZITADEL provides a…3.7
• CVE-2023-47112Rundeck is an open source automation service with a web cons…4.3
• CVE-2023-47113BleachBit cleans files to free disk space and to maintain pr…7.3