Unsafe Decompression Vulnerability in OpenTelemetry Collector Could Lead to Crash

CVE-2024-36129

What is CVE-2024-36129?

The OpenTelemetry Collector implements a vendor-agnostic framework for processing and exporting telemetry data. This vulnerability allows unauthenticated attackers to exploit unsafe decompression mechanisms within the collector, leading to significant memory consumption and potential crashes of the service. Affected versions prior to 0.102.1 for the OpenTelemetry Collector, and versions prior to 0.102.0 for the confighttp module and 0.102.1 for the configgrpc module, are particularly vulnerable. It is critical for users operating these versions to apply the recommended updates to mitigate risks associated with this vulnerability.

References