Critical Security Update for OpenTelemetry Collector: Denial of Service Vulnerability
Summary
ALSA-2026:1907: Important: opentelemetry-collector security update. Affects opentelemetry-collector versions < 0.135.0-3.el10_1. Fixed in 0.135.0-3.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenTelemetry Collector is a crucial component in the observability stack, designed to receive, process, and export telemetry data such as metrics and traces. It supports various components and is widely used in cloud-native applications for monitoring and performance analysis. However, a recently discovered vulnerability has raised concerns regarding its security, specifically related to resource consumption when handling crafted certificates.
Vulnerability Detail
The vulnerability identified as CVE-2025-61729 pertains to a Denial of Service (DoS) condition caused by excessive resource consumption when the OpenTelemetry Collector processes specially crafted X.509 certificates. This flaw can be exploited by an attacker to overwhelm the system, leading to service interruptions and degraded performance. The issue arises from the way the collector handles cryptographic operations, making it susceptible to resource exhaustion attacks.
How To Fix
Minimum fixed version
0.135.0-3.el10_1
This is the first release that contains the fix.
sudo dnf update opentelemetry-collectorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of the OpenTelemetry Collector to untrusted inputs or implement rate limiting on incoming requests to reduce the risk of exploitation until the patch is applied.
Conclusion
The OpenTelemetry Collector has a critical vulnerability that can lead to Denial of Service attacks due to excessive resource consumption. Users are strongly encouraged to update to the latest patched version to secure their systems. Temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for opentelemetry-collector →
FAQ
CVE-2025-61729 is a vulnerability in the OpenTelemetry Collector that allows for Denial of Service attacks due to excessive resource consumption when processing crafted X.509 certificates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to service interruptions, degraded performance, and potential downtime for applications relying on the OpenTelemetry Collector.
Yes, a patch is available in version 0.135.0-3.el10_1 of the OpenTelemetry Collector. Users are advised to update to this version or later.
If immediate updating is not possible, consider implementing rate limiting on incoming requests or restricting access to the OpenTelemetry Collector to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for opentelemetry-collector.
