CVE-2024-36129

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
open-telemetry	opentelemetry-collector	< 0.102.1
opentelemetry	opentelemetry	< 0.102.1

References

https://github.com/open-telemetry/opentelemetry-collector/pull/10289Patch
https://github.com/open-telemetry/opentelemetry-collector/pull/10323Patch
https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4vExploit, Third Party Advisory
https://opentelemetry.io/blog/2024/cve-2024-36129Vendor Advisory
https://github.com/open-telemetry/opentelemetry-collector/pull/10289Patch
https://github.com/open-telemetry/opentelemetry-collector/pull/10323Patch
https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4vExploit, Third Party Advisory
https://opentelemetry.io/blog/2024/cve-2024-36129Vendor Advisory

Timeline

Published: Jun 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-36135.4A vulnerability was found in SourceCodester Warehouse Management System 1.0. It has been rated as problematic. Affected by this issue is som CVE-2024-361309.8An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to CVE-2024-361318.8An insecure deserialization vulnerability in web component of EPMM prior to 12.1.0.1 allows an authenticated remote attacker to execute arbi CVE-2024-361327.5Insufficient verification of authentication controls in EPMM prior to 12.1.0.1 allows a remote attacker to bypass authentication and access CVE-2024-361367.5An off-by-one error in WLInfoRailService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting CVE-2024-361373.3A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used.CVE-2024-361388.1Bypass incomplete fix of CVE-2024-27980, that arises from improper handling of batch files with all possible extensions on Windows via child CVE-2024-36145.4A vulnerability classified as problematic has been found in SourceCodester Warehouse Management System 1.0. This affects an unknown part of CVE-2024-361405.4A vulnerability has been identified in OZW672 (All versions < V5.2), OZW772 (All versions < V5.2). The user accounts tab of affected devices CVE-2024-361415.4Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused CVE-2024-361425.4Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused CVE-2024-361435.4Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused