Hi,

The following vulnerability was published for opentelemetry-cpp.

CVE-2026-44967[0]:
| OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior
| to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs)
| read the full HTTP response into an in-memory vector of bytes
| without a size cap. This is exploitable for memory exhaustion when
| the configured collector endpoint is attacker-controlled (or a
| network attacker can MITM the exporter connection). This
| vulnerability is fixed in opentelemetry-cpp release 1.27.0.

https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj
https://github.com/open-telemetry/opentelemetry-cpp/issues/3958
https://github.com/open-telemetry/opentelemetry-cpp/pull/4078


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-44967
https://www.cve.org/CVERecord?id=CVE-2026-44967

Please adjust the affected versions in the BTS as needed.

We believe that the bug you reported is fixed in the latest version of
opentelemetry-cpp, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1139879@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Colin Watson <cjwatson@debian.org> (supplier of updated opentelemetry-cpp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 10 Sep 2026 09:29:57 +0100
Source: opentelemetry-cpp
Architecture: source
Version: 1.28.0-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
Changed-By: Colin Watson <cjwatson@debian.org>
Closes: 1139879
Changes:
 opentelemetry-cpp (1.28.0-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release:
     - CVE-2026-44967: Limit the size of HTTP responses to 4MiB by default
       (closes: #1139879).
   * Drop "Rules-Requires-Root: no", default as of dpkg-dev 1.22.13.
   * Drop "Priority: optional", default as of dpkg-dev 1.22.13.
   * Standards-Version: 4.7.4.
Checksums-Sha1:
 828bb04e840091df7e7344cacff8564724f6e7d6 2357 opentelemetry-cpp_1.28.0-1.dsc
 eed391df6eea245acffc88041c2d5ec8149ec8f1 1380604 opentelemetry-cpp_1.28.0.orig.tar.gz
 387fa8fe483833f54cb2270745ff2c11e926e28f 5096 opentelemetry-cpp_1.28.0-1.debian.tar.xz
 56dd528f61f064b56d2a6fc2028bf83dc8884313 8562 opentelemetry-cpp_1.28.0-1_source.buildinfo
Checksums-Sha256:
 c169eef02fa37a90220a325ae50036f32cee4d26f0559a28f243a61863fe0272 2357 opentelemetry-cpp_1.28.0-1.dsc
 8c359919175d77c502515f5a783907d031cc6a172e44426dbe9bee3c1532201e 1380604 opentelemetry-cpp_1.28.0.orig.tar.gz
 41de0fb7ce1c72327ade32c2bebcdacd9bfe576f74a6fc209dcd922c3d592525 5096 opentelemetry-cpp_1.28.0-1.debian.tar.xz
 63414265d617f8d1db5e9c8f9d9f3d3c45183b829475c38c7b4b707e843b8d5a 8562 opentelemetry-cpp_1.28.0-1_source.buildinfo
Files:
 61f11399a94bd5eee3fcb91b097efd2d 2357 libs optional opentelemetry-cpp_1.28.0-1.dsc
 f87f100d577bca42f4ee6b0463381fcb 1380604 libs optional opentelemetry-cpp_1.28.0.orig.tar.gz
 2e38d3afe27da708a083fcabe8766eef 5096 libs optional opentelemetry-cpp_1.28.0-1.debian.tar.xz
 2c540b11624a3a5d9de42cbe14c66115 8562 libs optional opentelemetry-cpp_1.28.0-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEErApP8SYRtvzPAcEROTWH2X2GUAsFAmqixFQACgkQOTWH2X2G
UAvvyA/9GDagHrawu9sXhF70pGSOSHi+X7L8oMo18lbofHr9Z5674jKFSQjoUX23
YJy2/cTJ7/X5DvC3LWH+iiLB+vCT+WuuruDyjpF+niC3cGYuVLg+zlhiw4aAVDua
fWr0tvptB8J+n+1JQH6J924AVS+9Abu2o9npB8Q2zxa5fIq897MiB2hEZAgc1uXY
e5TiTlkLURtIHpZ8eIV30/dCDa7aRYZzuRdpQW0lHRxUhjE/jvmCVuVQjkC401HW
tBtknZGVGkvk9PUlPluc7Fl7imb4VKwME/Kpfg69otRBvO4nkwGmZC9srTleljcR
X7rn+Xpz40Db3HVU9W6lI8HG/GN2WHkWw0RvadYhrx2cn4abfkRYa3G33jfrO46Y
103SqNM3RIMODNFMg/W21VAQ91fYJgHNYWfZefT1q0nBFwM0fmL7YnikJCMlIAlH
1J7QAehpPV6qfwaYHpFPb6qgSU65GzgMZ2bzc9UbjtgZtzTdN6Pj6U8WLk6p1I0L
h57bZ4mu0revBCiMpBK6f7w+lLxOf4snjA57+7tJkJ+pBxpRCFJT/dszRP7VV/Pb
Kl+qORpQjxPIEyWVkDjCZuZ5xmcxkoXRHpXzRJ+ExTZA2mjyhY6RRg5nO4kavdSi
MEb7nW/OQGKVlfNYhZ0idl0l9Rb7aYA8FAa1BgcW0i0CHG4shrI=
=XM4z
-----END PGP SIGNATURE-----