AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-28xm-prxc-5866: OpenTelemetry.Sampler.AWS & OpenTelemetry.Resources.AWS have unbounded HTTP response body reads

mediumvulnerability

security

Source: GitHub Advisory DatabaseApril 23, 2026CVE-2026-41173

Summary

Two OpenTelemetry libraries have a vulnerability where they read entire HTTP response bodies into memory without any size limit. An attacker controlling a remote endpoint or intercepting traffic (MitM, or man-in-the-middle attack, where someone secretly relays communications between two parties) could send a huge response to exhaust the application's memory and cause it to crash through an Out of Memory error.

Solution / Mitigation

Fixed in OpenTelemetry.Sampler.AWS version 0.1.0-alpha.8 and OpenTelemetry.Resources.AWS version 1.15.1. The fixes introduce limits to HttpClient requests so that the response body is streamed rather than buffered entirely in memory. Additionally, workarounds include: ensuring the X-Ray sampling endpoint is not accessible to untrusted parties, using network-level controls (firewall rules, mTLS, service mesh) to prevent Man-in-the-Middle attacks, and if using a remote endpoint, placing it behind a reverse proxy that enforces a response body size limit.