CVE-2026-44967

Name	CVE-2026-44967
Description	OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1139879

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
opentelemetry-cpp (PTS)	trixie	1.19.0-3	vulnerable
	forky, sid	1.23.0-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
opentelemetry-cpp	source	(unstable)	(unfixed)			1139879

Notes

[trixie] - opentelemetry-cpp <no-dsa> (Minor issue)
https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj
https://github.com/open-telemetry/opentelemetry-cpp/issues/3958
https://github.com/open-telemetry/opentelemetry-cpp/pull/4078