Описание
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.
A flaw was found in opentelemetry-js, specifically within the OpenTelemetry JavaScript (JS) Prometheus exporter. A remote attacker could exploit this vulnerability by sending a single malformed HTTP request to the metrics endpoint. This lack of proper error handling during URL parsing can cause an uncaught TypeError, leading to the termination of any Node.js process running the exporter. This results in a Denial of Service (DoS) for the affected system.
Отчет
This flaw is rated as Important. A remote attacker can trigger a Denial of Service by sending a malformed HTTP request to the OpenTelemetry JS Prometheus exporter's metrics endpoint, causing the Node.js process to terminate. This impacts Red Hat products that deploy the affected exporter, leading to service disruption.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Hardened Images | nodejs20 | Not affected | ||
| Red Hat Hardened Images | nodejs22 | Not affected | ||
| Red Hat Hardened Images | nodejs24 | Not affected | ||
| Red Hat Hardened Images | nodejs25 | Not affected | ||
| Red Hat Hardened Images | nodejs26 | Not affected | ||
| Red Hat Ansible Automation Platform 2.2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Fixed | RHSA-2026:51162 | 06.08.2026 |
| Red Hat Developer Hub 1.9 | rhdh/rhdh-hub-rhel9 | Fixed | RHSA-2026:41929 | 20.07.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.
Prometheus exporter process crash via malformed HTTP request
EPSS
7.5 High
CVSS3