DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

CVE-2023-47108

What is CVE-2023-47108?

A vulnerability exists in OpenTelemetry-Go Contrib prior to version 0.46.0, related to the gRPC Unary Server Interceptor that exposes unbound cardinality labels, specifically net.peer.sock.addr and net.peer.sock.port. This flaw can lead to memory exhaustion on the server side, potentially allowing attackers to overload the server with numerous malicious requests, resulting in resource depletion. To mitigate this issue, users are advised to upgrade to version 0.46.0 or implement workarounds such as using a view to remove the offending attributes or disabling gRPC metrics instrumentation.

References