Heap Allocation Vulnerability in OpenTelemetry Resources for Azure Environments

CVE-2026-41483

What is CVE-2026-41483?

The OpenTelemetry.Resources.Azure .NET resource detector for Azure environments is susceptible to a heap allocation vulnerability due to improper handling of HTTP responses from the Azure VM instance metadata service. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class allows attackers controlling the configured endpoint or those capable of intercepting traffic to deliver excessively large response bodies. This flaw results in unbounded heap allocation, causing high memory pressure, potential garbage collection stalls, or even terminating processes with an OutOfMemoryException. Users are advised to disable the Azure VM resource detector or implement network-level security measures to mitigate this risk. The vulnerability is addressed in version 1.15.1-beta.1, which streams responses rather than buffering them entirely, thus limiting memory usage and ignoring oversized responses.

References