Critical Security Update for OpenTelemetry Collector: Memory Exhaustion and Session Resumption Vulnerabilities
Summary
ALSA-2026:4174: Important: opentelemetry-collector security update. Affects opentelemetry-collector versions < 0.144.0-1.el10_1. Fixed in 0.144.0-1.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenTelemetry Collector is a crucial component in the observability stack, enabling the collection, processing, and export of telemetry data such as metrics, logs, and traces. It supports various components and is widely used in cloud-native applications to enhance monitoring and performance analysis. However, recent vulnerabilities have been identified that could compromise its functionality and security.
Vulnerability Detail
The vulnerabilities stem from two main issues: first, a memory exhaustion vulnerability in the net/url package, which can lead to denial of service through excessive memory consumption during query parameter parsing (CVE-2025-61726). Second, an unexpected session resumption issue in the crypto/tls package could allow attackers to exploit session management flaws, potentially leading to unauthorized access or data leakage (CVE-2025-68121). These vulnerabilities pose significant risks to applications relying on OpenTelemetry Collector for secure and efficient telemetry data handling.
How To Fix
Minimum fixed version
0.144.0-1.el10_1
This is the first release that contains the fix.
sudo dnf update opentelemetry-collectorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the number of concurrent requests to the OpenTelemetry Collector to mitigate the memory exhaustion issue. Additionally, consider implementing stricter session management practices to reduce the risk associated with session resumption vulnerabilities.
Conclusion
In summary, the OpenTelemetry Collector has critical vulnerabilities that need immediate attention. Updating to the latest patched version is essential to ensure the security and stability of applications using this tool. Temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for opentelemetry-collector →
FAQ
The OpenTelemetry Collector is a tool that helps in the collection, processing, and export of telemetry data, such as metrics and logs, from applications.
The vulnerabilities include a memory exhaustion issue in the net/url package and an unexpected session resumption issue in the crypto/tls package.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, consider implementing temporary workarounds such as limiting concurrent requests and enhancing session management.
For more details, refer to the CVE pages for CVE-2025-61726 and CVE-2025-68121, which provide in-depth information about the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for opentelemetry-collector.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
