{"cve":"CVE-2023-47108","nvd":{"published":"2023-11-10T19:15:16.410","modified":"2026-06-17T06:32:09.950","status":"Modified","description":"OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770"],"references":["https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327","https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138","https://github.com/open-telemetry/opentelemetry-go-contrib/commit/04c5dcbb5b35f14b4e6793b245919c72addbc7d0","https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b","https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322"],"products":["opentelemetry:opentelemetry"],"source":"nvd","synced_at":"2026-10-19T21:42:07.670898610+00:00"},"epss":{"cve":"CVE-2023-47108","score":0.02026,"percentile":0.81002,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-8pgv-569h-w5rw","url":"https://osv.dev/vulnerability/GHSA-8pgv-569h-w5rw","summary":"otelgrpc DoS vulnerability due to unbound cardinality metrics ","modified":"2026-09-10T03:49:58.904350912Z","packages":[{"ecosystem":"Go","name":"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc","purl":"pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc","ranges":[">=0.37.0 <0.46.0"],"fixed":["0.46.0"]}]},{"id":"GO-2023-2331","url":"https://osv.dev/vulnerability/GO-2023-2331","summary":"Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc","modified":"2026-02-04T04:40:53.262801Z","packages":[{"ecosystem":"Go","name":"go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc","purl":"pkg:golang/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc","ranges":[">=0.37.0 <0.46.0"],"fixed":["0.46.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}