Critical Security Update for opentelemetry-collector: Addressing Memory Exhaustion and TLS Session Resumption Vulnerabilities
Summary
ALSA-2026:4177: Important: opentelemetry-collector security update. Affects opentelemetry-collector versions < 0.144.0-1.el9_7. Fixed in 0.144.0-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The opentelemetry-collector is a crucial component in the OpenTelemetry framework, designed to collect and export telemetry data from various sources. It supports multiple components and is widely used in cloud-native applications to monitor performance and troubleshoot issues. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of systems utilizing this package.
Vulnerability Detail
The vulnerabilities stem from two main issues: first, a memory exhaustion problem in the net/url package, which can lead to denial of service by exhausting system memory during query parameter parsing (CVE-2025-61726). Second, an unexpected session resumption issue in the crypto/tls package, which could allow an attacker to exploit session resumption mechanisms, potentially leading to unauthorized access or data leakage (CVE-2025-68121). These vulnerabilities highlight the importance of maintaining up-to-date security practices in software development.
How To Fix
Minimum fixed version
0.144.0-1.el9_7
This is the first release that contains the fix.
sudo dnf update opentelemetry-collectorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can limit the number of concurrent requests to the opentelemetry-collector to mitigate the impact of the memory exhaustion vulnerability. This can be done by configuring your application to reduce the load on the collector until the update is applied.
Conclusion
In summary, the opentelemetry-collector has critical vulnerabilities that need immediate attention. Updating to the latest patched version is essential to ensure the security and stability of your applications. Utilize the provided resources to monitor and address these vulnerabilities effectively.
See every vulnerability recorded for opentelemetry-collector →
FAQ
The opentelemetry-collector is a tool that collects and exports telemetry data from various sources, helping developers monitor and troubleshoot applications.
The vulnerabilities include memory exhaustion in query parameter parsing (CVE-2025-61726) and unexpected session resumption in TLS (CVE-2025-68121).
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If an immediate update is not possible, consider implementing rate limiting on requests to the opentelemetry-collector as a temporary workaround.
For more details, refer to the CVE pages listed in the related section of the vulnerability advisory.
Related vulnerabilities
Recent vulnerabilities recorded for opentelemetry-collector.
