AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-vc24-j8c5-2vw4: OpenTelemetry.Resources.Azure has an unbounded HTTP response body read

mediumvulnerability

security

Source: GitHub Advisory DatabaseApril 29, 2026CVE-2026-41483

Summary

OpenTelemetry.Resources.Azure has a vulnerability where it reads unlimited amounts of data from Azure VM metadata service responses into memory, allowing an attacker to cause the application to crash by sending extremely large responses (a denial of service attack where the system runs out of memory). This affects applications using the Azure VM resource detector that connect to a compromised or intercepted metadata endpoint.

Solution / Mitigation

Fixed in OpenTelemetry.Resources.Azure version 1.15.0-beta.2. The fix introduces limits to HttpClient requests so that response bodies are streamed rather than loaded entirely into memory, with responses greater than 4 MiB being ignored. As workarounds, you can disable the Azure VM resource detector or use network-level controls (firewall rules, mTLS, or service mesh) to prevent Man-in-the-Middle attacks on the Azure VM instance metadata endpoint.