A flaw in OpenTelemetry.Sampler.AWS allows an attacker that can control or intercept the configured AWS X‑Ray remote sampling endpoint to return an arbitrarily large HTTP response body. The sampler reads the entire response into memory with no size limit, causing unbounded heap allocation, high memory pressure, garbage‑collection stalls, or an OutOfMemoryException that terminates the process. This vulnerability can be exploited locally or remotely if the attacker can influence the endpoint the application uses.

The issue affects the OpenTelemetry .NET Contrib library, specifically the AWS X‑Ray Remote Sampler component in versions prior to 0.1.0‑alpha.8. Any process using this supplier and connecting to a remote sampling endpoint can be impacted.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score of less than 1% shows that exploit probability is low at present and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an attacker to control the endpoint or perform a man‑in‑the‑middle to supply a large response; this is feasible if the endpoint is not properly secured or restricted.