Unbounded Memory Allocation in AWS X-Ray Remote Sampler by OpenTelemetry

CVE-2026-41173

What is CVE-2026-41173?

The AWS X-Ray Remote Sampler component of OpenTelemetry is susceptible to a vulnerability that allows for unbounded memory allocation when processing HTTP responses from a configured sampling endpoint. Prior to version 0.1.0-alpha.8, the sampler would read entire HTTP response bodies into memory without any restrictions. If an attacker influences the endpoint or intercepts the traffic (through a Man-in-the-Middle attack), they could provide an excessively large HTTP response. This can lead to significant memory pressure on the application, causing potential garbage collection delays or an OutOfMemoryException, which could disrupt the application's operation. Users are urged to upgrade to the latest version to mitigate the risks associated with this vulnerability.

References