The vulnerability lies in the OpenTelemetry C++ library where OTLP HTTP exporters read the entire HTTP response into an uncapped in‑memory vector. An attacker who supplies a large or infinite response can trigger excessive memory consumption, potentially exhausting system resources and causing denial of service. This weakness corresponds to CWE‑789, unbounded memory allocation.

Affected versions are all releases of OpenTelemetry C++ before 1.27.0, specifically the OTLP HTTP exporters for traces, metrics, and logs. The product is the open‑telemetry:opentelemetry‑cpp implementation.

The CVSS score of 5.3 indicates a moderate impact, and an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker who can manipulate the collector endpoint, either by directly controlling it or by man‑in‑the‑middle attacks that redirect the exporter to a malicious server. The attack path does not require privileged access and thus can be launched remotely against any deployment that uses an untrusted endpoint.