CVE-2026-42348

When receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed.

This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response.

Details

#2926 introduced the initial HTTP transport components which uses ReadAsByteArrayAsync to copy the HttpResponseMessage.Content into a byte array. This code path allows an unbounded read of the entire HTTP response message.

Mitigation

The application's configured OpAMP server needs to behave maliciously. If the OpAMP server is a well-behaved implementation, response bodies should not be excessively large.

Workarounds

None known.

Resources

• #2926
• #4116
• CWE-789

If an application using the OpAMP client is configured to use an OpAMP server that is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response, the application could have its memory exhausted and create a denial-of-service condition.

CVE-2026-42348 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.2.0-alpha.1); upgrading removes the vulnerable code path.

Kodem intelligence

#4116 updates the OpAMP client HTTP transport to limit the maximum size of responses to 128KB.

1. What is CVE-2026-42348? CVE-2026-42348 is a medium-severity security vulnerability in OpenTelemetry.OpAmp.Client (nuget), affecting versions < 0.2.0-alpha.1. It is fixed in 0.2.0-alpha.1.
2. How severe is CVE-2026-42348? CVE-2026-42348 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of OpenTelemetry.OpAmp.Client are affected by CVE-2026-42348? OpenTelemetry.OpAmp.Client (nuget) versions < 0.2.0-alpha.1 is affected.
4. Is there a fix for CVE-2026-42348? Yes. CVE-2026-42348 is fixed in 0.2.0-alpha.1. Upgrade to this version or later.
5. Is CVE-2026-42348 exploitable, and should I be worried? Whether CVE-2026-42348 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-42348 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-42348? Upgrade OpenTelemetry.OpAmp.Client to 0.2.0-alpha.1 or later.