Critical Security Update for opentelemetry-collector: Denial of Service Vulnerability
Summary
ALSA-2026:76743: Important: opentelemetry-collector security update. Affects opentelemetry-collector versions < 0.158.0-1.el10_2. Fixed in 0.158.0-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The opentelemetry-collector is a crucial component in the OpenTelemetry framework, designed to facilitate the collection, processing, and export of telemetry data such as metrics and traces. It supports various components and is widely used in cloud-native applications to enhance observability. However, a recent vulnerability has been identified that could potentially compromise its functionality and the applications relying on it.
Vulnerability Detail
The vulnerability identified as CVE-2026-84445 affects the gRPC-Go library used within the opentelemetry-collector. It allows for a Denial of Service (DoS) attack via malformed RPC requests. Attackers can exploit this vulnerability to disrupt the service, leading to application downtime and loss of telemetry data. This issue arises from improper handling of certain RPC requests, which can overwhelm the service and render it unresponsive.
How To Fix
Minimum fixed version
0.158.0-1.el10_2
This is the first release that contains the fix.
sudo dnf update opentelemetry-collectorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider implementing rate limiting on the gRPC endpoints to mitigate the impact of potential DoS attacks until the package can be updated.
Conclusion
The opentelemetry-collector has a critical vulnerability that can lead to Denial of Service attacks. It is crucial to update to the latest patched version to safeguard your applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for opentelemetry-collector →
FAQ
CVE-2026-84445 is a vulnerability in the gRPC-Go library used by opentelemetry-collector, which allows for Denial of Service attacks through malformed RPC requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to service disruptions, application downtime, and loss of critical telemetry data, impacting observability.
Yes, a patch is available in version 0.158.0-1.el10_2 of the opentelemetry-collector package.
If immediate updates are not possible, consider implementing rate limiting on gRPC endpoints to reduce the risk of a DoS attack.
Related vulnerabilities
Recent vulnerabilities recorded for opentelemetry-collector.
