Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
open-telemetry/opentelemetry-python-contrib
main @ ec27300
9
Fixes
0
CVEs
HIGH
Peak severity
28.6%
Coverage
Highlights
Information Disclosure: 5 prior fixes. Scrutinize any change in this area.
opentelemetry-instrumentation-elasticsearch: most-fixed (2 issues). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Information Disclosure: Elasticsearch query bodies can bypass sanitization completely if they are structured as raw strings or if nested leaf keys are not recursively checked, allowing sensitive database payloads to leak into telemetry spans. This is a recurring vulnerability requiring robust structural parsing and masking of all leaf nodes.
Denial of Service: Unbounded cardinality in metric labels, such as recording raw HTTP request methods without validation, allows clients to exhaust system memory. Validating and sanitizing input methods before generating metric keys is critical to prevent resource exhaustion.
Denial of Service: Unbounded thread creation in the upload completion hook's executor can lead to OS resource exhaustion. Hard limits must be placed on the maximum number of worker threads utilized during background tasks.