AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-55m9-299j-53c7: OneCollector exporter reads unbounded HTTP response bodies

mediumvulnerability

security

Source: GitHub Advisory DatabaseApril 29, 2026CVE-2026-41484

Summary

The OneCollector exporter (a tool that sends telemetry data, which is information about how a program is running, to a backend server) has a flaw where it reads error responses from failed HTTP requests without limiting how much data it accepts. If an attacker controls the backend server or intercepts the connection, they can send an extremely large response that exhausts the application's memory and crashes it (a denial-of-service attack, where a system is made unavailable).

Solution / Mitigation

Update to the version with PR #4117 applied, which limits the number of bytes read from error response bodies to 4MiB (megabytes). Additionally, use network-level controls like firewall rules, mTLS (mutual TLS, a security protocol for encrypting connections), or a service mesh to prevent Man-in-the-Middle attacks on the configured backend/collector endpoint.