{
  "schema_version": "1.3.1",
  "id": "GO-2023-2331",
  "modified": "0001-01-01T00:00:00Z",
  "published": "0001-01-01T00:00:00Z",
  "aliases": [
    "CVE-2023-47108",
    "GHSA-8pgv-569h-w5rw"
  ],
  "summary": "Denial of service in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
  "details": "The grpc Unary Server Interceptor created by the otelgrpc package added the labels net.peer.sock.addr and net.peer.sock.port with unbounded cardinality. This can lead to the server's potential memory exhaustion when many malicious requests are sent. This leads to a denial-of-service.",
  "affected": [
    {
      "package": {
        "name": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.46.0"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
            "symbols": [
              "StreamClientInterceptor",
              "StreamServerInterceptor",
              "UnaryClientInterceptor",
              "UnaryServerInterceptor",
              "spanInfo"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw"
    },
    {
      "type": "FIX",
      "url": "https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b"
    },
    {
      "type": "FIX",
      "url": "https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2023-2331",
    "review_status": "REVIEWED"
  }
}