CVE-2024-36129 HIGH

CVE-2024-36129: OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

Vendor Open-Telemetry
Product opentelemetry-collector
Weakness CWE-119
Published June 5, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

Key dates

02Disclosure timeline

June 5, 2024 CVE published
August 2, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-7323 IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability CVE-2026-39892 cryptography has a buffer overflow if non-contiguous buffers were passed to APIs CVE-2025-7301 IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability CVE-2023-39486 PDF-XChange Editor JP2 File Parsing Memory Corruption Remote Code Execution Vulnerability CVE-2025-1178 GNU Binutils ld libbfd.c bfd_putl64 memory corruption