Hi,

The following vulnerability was published for opentelemetry-cpp.

CVE-2026-44967[0]:
| OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior
| to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs)
| read the full HTTP response into an in-memory vector of bytes
| without a size cap. This is exploitable for memory exhaustion when
| the configured collector endpoint is attacker-controlled (or a
| network attacker can MITM the exporter connection). This
| vulnerability is fixed in opentelemetry-cpp release 1.27.0.

https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj
https://github.com/open-telemetry/opentelemetry-cpp/issues/3958
https://github.com/open-telemetry/opentelemetry-cpp/pull/4078


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44967
https://www.cve.org/CVERecord?id=CVE-2026-44967

Please adjust the affected versions in the BTS as needed.