IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.5Hoch

CVE-2026-44902opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

open-telemetry opentelemetry-js; @opentelemetry exporter-prometheus; @opentelemetry sdk-node; @opentelemetry auto-instrumentations-node Veröffentlicht: (vor 5 Monaten)

Beschreibung

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.

Schwachstellentyp (CWE): CWE-755

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
open-telemetry opentelemetry-js < 0.217.0
@opentelemetry auto-instrumentations-node < 0.75.0
@opentelemetry exporter-prometheus < 0.217.0
opentelemetry opentelemetry/auto-instrumentations-node < 0.75.0
opentelemetry opentelemetry/exporter-prometheus < 0.217.0
opentelemetry opentelemetry/sdk-node < 0.217.0
@opentelemetry sdk-node < 0.217.0

Referenzen und Patches

CPE-Treffer (NVD) (3)
  • cpe:2.3:a:opentelemetry:opentelemetry\/auto-instrumentations-node:*:*:*:*:*:node.js:*:* < 0.75.0
  • cpe:2.3:a:opentelemetry:opentelemetry\/exporter-prometheus:*:*:*:*:*:node.js:*:* < 0.217.0
  • cpe:2.3:a:opentelemetry:opentelemetry\/sdk-node:*:*:*:*:*:node.js:*:* < 0.217.0