CVE-2023-45142: OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

Modified

AliasesUBUNTU-CVE-2023-45142CGA-2fjh-h3c2-xp7gCGA-2g6w-v755-qv4w+247 more

Published 12-10-2023Last modified 13-02-2025

Vulnerability summary

CVE-2023-45142 is a high (CVSS 7.5) vulnerability in open-telemetry opentelemetry-go-contrib. EPSS estimates a 1.61% chance of exploitation in the next 30 days, higher than 76% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (CVE.org)

EPSS score

1.61%

0%100%

Low · +0.25 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 16 · Related 53

OPENSUSE-SU-2024:0211-1 OPENSUSE-SU-2024:0220-1 OPENSUSE-SU-2024:13360-1 OPENSUSE-SU-2024:14320-1 OPENSUSE-SU-2024:14321-1 RHSA-2024:4118+48 more

Timeline

12-10-2023
PublishedVulnerability first disclosed.
13-02-2025
Last modifiedVulnerability information updated.

Description

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.

CVSS metrics

7 scores · 7 sources · 1 version

v3.17.5

EPSS trend

Probability

1.61%

Chance of exploitation in the next 30 days

Percentile

76%

Versus all other CVEs

30-day change

Increase +0.25 pp

From 1.36% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard112 products

azure-container-networkingAll versions (No fix recorded)
azure-vnet-cniAll versions (No fix recorded)
buildkitd< 0.25.2-r1
caddy< 2.7.5-r1
k3s< 1.28.2-r2

kube-apiserver-1.32< 1.32.0-r2
kube-apiserver-1.32-default< 1.32.0-r2
kube-apiserver-1.32-default-compat< 1.32.0-r2
kube-apiserver-1.33< 1.33.0-r1
kube-apiserver-1.33-default< 1.33.0-r1
kube-apiserver-1.33-default-compat< 1.33.0-r1
kube-apiserver-fips-1.32< 1.32.0-r1
kube-apiserver-fips-1.32-default< 1.32.0-r1
kube-apiserver-fips-1.32-default-compat< 1.32.0-r1
kube-conformance-1.32All versions (No fix recorded)
kube-conformance-1.33All versions (No fix recorded)
kube-controller-manager-1.32< 1.32.0-r2
kube-controller-manager-1.32-default< 1.32.0-r2
kube-controller-manager-1.32-default-compat< 1.32.0-r2
kube-controller-manager-1.33< 1.33.0-r1
kube-controller-manager-1.33-default< 1.33.0-r1
kube-controller-manager-1.33-default-compat< 1.33.0-r1
kube-controller-manager-fips-1.32< 1.32.0-r1
kube-controller-manager-fips-1.32-default< 1.32.0-r1
kube-controller-manager-fips-1.32-default-compat< 1.32.0-r1
kube-oidc-proxy< 1.0.5-r1
kube-proxy-1.32< 1.32.0-r2
kube-proxy-1.32-default< 1.32.0-r2
kube-proxy-1.32-default-compat< 1.32.0-r2
kube-proxy-1.33< 1.33.0-r1
kube-proxy-1.33-default< 1.33.0-r1
kube-proxy-1.33-default-compat< 1.33.0-r1
kube-proxy-fips-1.32< 1.32.0-r1
kube-proxy-fips-1.32-default< 1.32.0-r1
kube-proxy-fips-1.32-default-compat< 1.32.0-r1
kube-scheduler-1.32< 1.32.0-r2
kube-scheduler-1.32-default< 1.32.0-r2
kube-scheduler-1.32-default-compat< 1.32.0-r2
kube-scheduler-1.33< 1.33.0-r1
kube-scheduler-1.33-default< 1.33.0-r1
kube-scheduler-1.33-default-compat< 1.33.0-r1
kube-scheduler-fips-1.32< 1.32.0-r1
kube-scheduler-fips-1.32-default< 1.32.0-r1
kube-scheduler-fips-1.32-default-compat< 1.32.0-r1
kubeadm-1.32< 1.32.0-r2
kubeadm-1.32-default< 1.32.0-r2
kubeadm-1.32-default-compat< 1.32.0-r2
kubeadm-1.33< 1.33.0-r1
kubeadm-1.33-default< 1.33.0-r1
kubeadm-1.33-default-compat< 1.33.0-r1
kubeadm-fips-1.32< 1.32.0-r1
kubeadm-fips-1.32-default< 1.32.0-r1
kubeadm-fips-1.32-default-compat< 1.32.0-r1
kubectl-1.25All versions (No fix recorded)
kubectl-1.25-defaultAll versions (No fix recorded)
kubectl-1.26All versions (No fix recorded)
kubectl-1.26-defaultAll versions (No fix recorded)
kubectl-1.27All versions (No fix recorded)
kubectl-1.27-defaultAll versions (No fix recorded) | < 1.27.11-r1
kubectl-1.28< 1.28.9-r0 | All versions (No fix recorded)
kubectl-1.28-defaultAll versions (No fix recorded) | < 1.28.9-r0 | < 1.28.7-r1
kubectl-1.29< 1.29.3-r1
kubectl-1.29-default< 1.29.3-r1
kubectl-1.32< 1.32.0-r2
kubectl-1.32-default< 1.32.0-r2
kubectl-1.32-default-compat< 1.32.0-r2
kubectl-1.32-iamguarded-compat< 1.32.0-r2
kubectl-1.33< 1.33.0-r1
kubectl-1.33-default< 1.33.0-r1
kubectl-1.33-default-compat< 1.33.0-r1
kubectl-1.33-iamguarded-compat< 1.33.0-r1
kubectl-bash-completion-1.25All versions (No fix recorded)
kubectl-bash-completion-1.26All versions (No fix recorded)
kubectl-bash-completion-1.27All versions (No fix recorded)
kubectl-bash-completion-1.28All versions (No fix recorded) | < 1.28.9-r0
kubectl-bash-completion-1.29< 1.29.3-r1
kubectl-bash-completion-1.32< 1.32.0-r2
kubectl-bash-completion-1.33< 1.33.0-r1
kubectl-bash-completion-fips-1.32< 1.32.0-r1
kubectl-fips-1.32< 1.32.0-r1
kubectl-fips-1.32-default< 1.32.0-r1
kubectl-fips-1.32-default-compat< 1.32.0-r1
kubelet-1.32< 1.32.0-r2
kubelet-1.32-default< 1.32.0-r2
kubelet-1.32-default-compat< 1.32.0-r2
kubelet-1.33< 1.33.0-r1
kubelet-1.33-default< 1.33.0-r1
kubelet-1.33-default-compat< 1.33.0-r1
kubelet-fips-1.32< 1.32.0-r1
kubelet-fips-1.32-default< 1.32.0-r1
kubelet-fips-1.32-default-compat< 1.32.0-r1
kubelet-fips-1.33All versions (No fix recorded)
kubernetes-1.32< 1.32.0-r2
kubernetes-1.32-default< 1.32.0-r2
kubernetes-1.33< 1.33.0-r1
kubernetes-1.33-default< 1.33.0-r1
kubernetes-fips-1.32< 1.32.0-r1
kubernetes-fips-1.32-default< 1.32.0-r1
kubernetes-fips-1.33All versions (No fix recorded)
kubernetes-pause-1.32< 1.32.0-r2
kubernetes-pause-1.33< 1.33.0-r1
kubernetes-pause-compat-1.32< 1.32.0-r2
kubernetes-pause-compat-1.33< 1.33.0-r1
kubevela< 1.9.7-r3
metrics-serverAll versions (No fix recorded)
metrics-server-fips< 0.6.4-r3
prometheus-adapter< 0.11.1-r4
prometheus-adapter-0.10< 0.10.1-r28 | All versions (No fix recorded)
prometheus-adapter-fips-0.10All versions (No fix recorded)
rancher-webhook-0.4< 0.4.9-r1
rancher-webhook-fips-0.4< 0.4.18-r14
up< 0.24.0-r1

Show all 112

Wolfi26 products

buildkitd< 0.25.2-r1
caddy< 2.7.5-r1
k3s< 1.28.2-r2
kubectl-1.25All versions (No fix recorded)
kubectl-1.25-defaultAll versions (No fix recorded)

Show all 26

Opensuse2 products

caddy&distro=openSUSE Tumbleweed< 2.7.6-1.1
golang-github-prometheus-prometheus&distro=openSUSE Tumbleweed< 2.53.0-3.1

Alpine1 product

k3s< 1.29.3.1-r0

Go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful1 product

otelrestful< 0.44.0

Go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin1 product

otelgin< 0.44.0

Go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux1 product

otelmux< 0.44.0

Go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo1 product

otelecho< 0.44.0

Go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v11 product

otelmacaron< 0.44.0

Go.opentelemetry.io/contrib/instrumentation/net/http1 product

otelhttp< 0.44.0

Go.opentelemetry.io/contrib/instrumentation/net/http/httptrace1 product

otelhttptrace< 0.44.0

Open-telemetry1 product

opentelemetry-go-contrib< 0.44.0

Opentelemetry1 product

opentelemetry< 0.44.0

Ubuntu1 product

golang-opentelemetry-contribAll versions (No fix recorded)

14 vendors · 151 products

References

17 links

github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmrX Refsource CONFIRMAdvisoryWEBVendor Advisory
github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrhX Refsource MISCAdvisoryWEBVendor Advisory
github.com/open-telemetry/opentelemetry-go-contrib/pull/4277X Refsource MISCFIXWEBIssue Tracking
github.com/advisories/GHSA-cg3q-j54f-5p7pX Refsource MISCAdvisoryThird Party Advisory
github.com/open-telemetry/…X Refsource MISCWEBProduct
github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0X Refsource MISCWEBRelease Notes
github.com/open-telemetry/…X Refsource MISCWEBProduct
github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.goX Refsource MISCWEBProduct
lists.fedoraproject.org/archives/…WEB
ubuntu.com/security/CVE-2023-45142REPORT

Show all 17 references