OpenTelemetry .NET gRPC Exporter Denial-of-Service Vulnerability via Malformed Status Trailer

A denial-of-service vulnerability has been identified in the OpenTelemetry .NET exporter when exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP). This issue affects versions 1.13.1 prior to 1.15.2. The vulnerability arises during the retry handling of server-provided 'grpc-status-details-bin' trailers. A malformed trailer could encode an excessively large length-delimited protobuf field, which was directly used for memory allocation. This allowed for excessive memory usage, potentially leading to process instability or a crash.

Impact

Exploitation of this vulnerability can cause excessive memory allocation, leading to memory exhaustion and process instability or crash, causing a denial-of-service condition.

Remediation

Users can upgrade to OpenTelemetry .NET version 1.15.2 or later, where this vulnerability has been fixed.