The OpAMP client, used by OpenTelemetry .NET, reads HTTP responses without imposing any upper bound on the size of the response body. An attacker who can control the OpAMP server or perform a man‑in‑the‑middle attack can cause the client to allocate an arbitrarily large buffer, leading to excessive memory consumption and potential application failure. This vulnerability is classified as CWE‑789 (Uncontrolled Memory Allocation).

OpenTelemetry .NET OpAMP client, part of the OpenTelemetry dotnet contrib library. Versions before 0.2.0‑alpha.1 are affected; the fix is incorporated in 0.2.0‑alpha.1 and later releases.

The CVSS score of 5.9 indicates moderate severity, and no EPSS information is available. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw by directing an application to an attacker‑controlled OpAMP server or by intercepting traffic and injecting a large HTTP body. Successful exploitation can exhaust application memory and cause a crash or unresponsiveness, resulting in a denial‑of‑service condition for any users of the application.