Critical Security Update for OpenTelemetry Collector: Denial of Service Vulnerability
Summary
ALSA-2025:23729: Important: opentelemetry-collector security update. Affects opentelemetry-collector versions < 0.135.0-2.el9_7. Fixed in 0.135.0-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenTelemetry Collector is a crucial component in the observability ecosystem, designed to receive, process, and export telemetry data such as metrics and traces. It supports various plugins and components, making it versatile for different environments. However, it has been identified to have a significant vulnerability that can lead to denial of service, affecting its reliability and performance.
Vulnerability Detail
The vulnerability arises from an uncontrolled recursion in expression evaluation within the Expr library used by OpenTelemetry Collector. This flaw, identified as CVE-2025-68156, can be exploited to cause a denial of service, potentially leading to service outages and degraded performance. Attackers can craft specific inputs that trigger excessive recursion, consuming system resources and making the service unresponsive.
How To Fix
Minimum fixed version
0.135.0-2.el9_7
This is the first release that contains the fix.
sudo dnf update opentelemetry-collectorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the input size or complexity of expressions processed by the OpenTelemetry Collector to mitigate the risk of triggering the vulnerability until the update is applied.
Conclusion
The OpenTelemetry Collector has a critical vulnerability that can lead to denial of service. It is imperative to update to the latest patched version to ensure the security and reliability of your telemetry data processing. Implementing the recommended fixes and workarounds will help mitigate potential risks.
See every vulnerability recorded for opentelemetry-collector →
FAQ
CVE-2025-68156 is a vulnerability in the Expr library used by OpenTelemetry Collector that allows for denial of service through uncontrolled recursion.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your manifest file like package-lock.json, you can determine if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to denial of service, causing the OpenTelemetry Collector to become unresponsive and impacting the observability of your applications.
Yes, you can limit the complexity of expressions processed by the OpenTelemetry Collector as a temporary workaround until you can apply the update.
For more details, refer to the CVE page associated with CVE-2025-68156, which provides in-depth information about the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for opentelemetry-collector.
