CVE-2026-41173: 
C# vulnerability analysis and mitigation

CVE-2026-41173 is an unbounded HTTP response body read vulnerability affecting the OpenTelemetry.Sampler.AWS and OpenTelemetry.Resources.AWS packages in the opentelemetry-dotnet-contrib project. It allows an attacker who controls or can intercept traffic to the configured AWS X-Ray remote sampling endpoint (or AWS EC2/ECS/EKS metadata endpoints) to cause excessive heap memory allocation, potentially crashing the consuming process via an OutOfMemoryException. Affected versions are OpenTelemetry.Sampler.AWS prior to 0.1.0-alpha.8 and OpenTelemetry.Resources.AWS prior to 1.15.1. The vulnerability was published on April 23, 2026, with a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory, Security Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). In OpenTelemetry.Sampler.AWS, the method AWSXRaySamplerClient.DoRequestAsync calls HttpClient.SendAsync followed by ReadAsStringAsync(), which materializes the entire HTTP response body into a single in-memory string with no size cap. Similarly, in OpenTelemetry.Resources.AWS, the AWSEC2Detector, AWSECSDetector, and AWSEKSDetector classes make unbounded HTTP reads from AWS instance metadata service endpoints. An attacker must either control the configured sampling/metadata endpoint or perform a Man-in-the-Middle (MitM) attack on the unencrypted HTTP traffic to those endpoints (e.g., the default http://localhost:2000 for X-Ray sampling, or http://169.254.169.254 for EC2 metadata) to return an arbitrarily large response body (Github Advisory, PR #4100).

Successful exploitation results in a Denial of Service (DoS) condition exclusively affecting availability — there is no confidentiality or integrity impact. An attacker can force unbounded heap allocation in the .NET process consuming the vulnerable package, leading to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the application. The impact is limited to the affected process and does not directly enable lateral movement or data exfiltration (Github Advisory, Security Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (5th percentile), indicating a very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity — the attacker must either control the configured endpoint or successfully perform a MitM attack on the HTTP traffic, which limits opportunistic exploitation (Github Advisory).

1. Identify target: Locate a .NET application using OpenTelemetry.Sampler.AWS (< 0.1.0-alpha.8) or OpenTelemetry.Resources.AWS (< 1.15.1) that communicates with a configurable or interceptable AWS X-Ray or metadata endpoint.
2. Determine endpoint: Identify the configured sampling endpoint (default: http://localhost:2000) or metadata endpoints (http://169.254.169.254, ECS/EKS metadata URIs). If the endpoint is remote or misconfigured to point to an attacker-reachable host, proceed directly to step 4.
3. Position for MitM (if needed): If the endpoint is the default localhost or a trusted host, gain a network position to intercept HTTP traffic — for example, via ARP spoofing, DNS poisoning, or compromising a network device on the path between the application and the endpoint.
4. Serve oversized response: Stand up a malicious HTTP server (or intercept and modify responses) at the target endpoint that returns an arbitrarily large HTTP response body (e.g., hundreds of megabytes or gigabytes of data) in response to sampling rule or metadata requests.
5. Trigger memory exhaustion: The vulnerable ReadAsStringAsync() call materializes the entire response into memory with no size limit, causing heap exhaustion, garbage-collection stalls, or an OutOfMemoryException that crashes the target process (Github Advisory, PR #4100).

• Network: Unusually large HTTP responses (hundreds of MB or more) originating from the AWS X-Ray sampling endpoint (http://localhost:2000 or configured remote host) or AWS metadata endpoints (http://169.254.169.254, ECS/EKS metadata URIs); unexpected outbound connections from the application host to unknown IPs on port 2000 or metadata service ports.
• Process: Sudden spike in .NET process memory consumption correlated with sampling rule refresh intervals; OutOfMemoryException entries in application logs or crash dumps; abnormal garbage collection frequency or duration visible in runtime metrics.
• Logs: Application crash logs or event logs showing System.OutOfMemoryException originating from AWSXRaySamplerClient.DoRequestAsync or AWS resource detector classes; .NET runtime event log entries indicating process termination due to memory exhaustion.

Upgrade to the patched versions: OpenTelemetry.Sampler.AWS 0.1.0-alpha.8 and OpenTelemetry.Resources.AWS 1.15.1. The fixes (PRs #4100 and #4122) introduce a LimitedStream wrapper that caps HTTP response body reads at 1 MB, replacing the unbounded ReadAsStringAsync() call. If immediate upgrade is not possible, apply the following workarounds: ensure the X-Ray sampling endpoint (http://localhost:2000) is not accessible to untrusted parties; use network-level controls (firewall rules, mTLS, service mesh) to prevent MitM attacks on sampling and metadata endpoints; and if using a remote endpoint, place it behind a reverse proxy that enforces a response body size limit (Github Advisory, Security Advisory).