CVE-2024-36129
📋 TL;DR
CVE-2024-36129 is an unsafe decompression vulnerability in OpenTelemetry Collector that allows unauthenticated attackers to crash the service via excessive memory consumption (denial of service). This affects all OpenTelemetry Collector deployments using vulnerable versions that accept compressed data. The vulnerability is fixed in version 0.102.1.
💻 Affected Systems
- OpenTelemetry Collector
📦 What is this software?
Configgrpc by Opentelemetry
Confighttp by Opentelemetry
Opentelemetry Collector by Opentelemetry
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of OpenTelemetry Collector leading to loss of telemetry data collection and potential cascading failures in monitoring systems.
Likely Case
Service crashes and restarts, causing gaps in telemetry data collection and potential alerting failures.
If Mitigated
Minimal impact with proper network segmentation and rate limiting preventing exploitation attempts.
🎯 Exploit Status
The vulnerability is straightforward to exploit by sending specially crafted compressed payloads to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.102.1
Vendor Advisory: https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
Restart Required: Yes
Instructions:
1. Update OpenTelemetry Collector to version 0.102.1 or later. 2. Update confighttp module to 0.102.0+ and configgrpc module to 0.102.1+. 3. Restart all collector instances. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable compression
allConfigure collectors to reject compressed payloads if not required
Configure collector to set 'compression: none' in receiver configurations
Network segmentation
allRestrict access to collector endpoints to trusted sources only
Use firewall rules to limit access to collector ports (e.g., 4317, 4318, 55680, 55681)
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send data to collectors
- Deploy rate limiting at network or application level to prevent exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check OpenTelemetry Collector version: if version < 0.102.1, you are vulnerable. Also check confighttp module < 0.102.0 or configgrpc module < 0.102.1.Check Version:
otelcol --versionVerify Fix Applied:
Verify version is 0.102.1 or higher and test that collector accepts compressed data without crashing.📡 Detection & Monitoring
Log Indicators:
- Collector process crashes or restarts
- Memory usage spikes followed by crashes
- Errors related to decompression or memory allocation
Network Indicators:
- Unusually large compressed payloads sent to collector endpoints
- Multiple rapid connection attempts to collector ports
SIEM Query:
source="otel-collector" AND ("panic" OR "out of memory" OR "decompression failed")🔗 References
- https://github.com/open-telemetry/opentelemetry-collector/pull/10289
- https://github.com/open-telemetry/opentelemetry-collector/pull/10323
- https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
- https://opentelemetry.io/blog/2024/cve-2024-36129
- https://github.com/open-telemetry/opentelemetry-collector/pull/10289
- https://github.com/open-telemetry/opentelemetry-collector/pull/10323
- https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
- https://opentelemetry.io/blog/2024/cve-2024-36129
