CVE-2023-47108: OpenTelemetry-Go Contrib DoS Vulnerability

CVE-2023-47108 Overview

CVE-2023-47108 is a memory exhaustion vulnerability in OpenTelemetry-Go Contrib, a collection of third-party packages for OpenTelemetry-Go. The vulnerability exists in the gRPC Unary Server Interceptor, which automatically adds the net.peer.sock.addr and net.peer.sock.port labels with unbound cardinality. This design flaw allows attackers to flood the server with requests using varied peer addresses and ports, leading to potential memory exhaustion and denial of service conditions.

Critical Impact

This vulnerability enables remote attackers to cause memory exhaustion on servers using affected versions of the OpenTelemetry-Go Contrib gRPC instrumentation, potentially leading to complete service disruption without requiring authentication.

Affected Products

• OpenTelemetry-Go Contrib versions 0.37.0 through 0.45.x
• gRPC Unary Server Interceptor component (otelgrpc)
• Applications using go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc

Discovery Timeline

• 2023-11-10 - CVE-2023-47108 published to NVD
• 2025-10-28 - Last updated in NVD database

Technical Details for CVE-2023-47108

Vulnerability Analysis

The vulnerability stems from how the OpenTelemetry-Go Contrib gRPC instrumentation handles metric labeling. The gRPC Unary Server Interceptor automatically attaches net.peer.sock.addr and net.peer.sock.port attributes to metrics for each incoming request. Since these attributes capture the remote peer's address and port, they inherently have unbounded cardinality—meaning the number of unique combinations can grow infinitely based on the number of distinct clients connecting to the service.

In observability systems, each unique combination of metric labels creates a new time series that must be stored and tracked in memory. When an attacker sends requests from many different source addresses and ports (which is trivial to accomplish), the server must allocate memory to track each unique combination. This creates a classic resource exhaustion scenario where the attacker can deplete server memory resources with minimal effort.

Root Cause

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The interceptor code at the telemetryAttributes function captured peer connection information without consideration for the cardinality implications. The vulnerable code path in interceptor.go collected these high-cardinality attributes and passed them to the metrics system, which created unbounded memory growth as new unique attribute combinations were encountered.

Attack Vector

This is a network-based attack requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a target service using the vulnerable OpenTelemetry-Go Contrib gRPC instrumentation
2. Sending gRPC requests from multiple source IP addresses and ports (easily achieved through IP spoofing, botnets, or simply using many connections)
3. Each unique IP:port combination creates new metric time series in memory
4. Continuing the attack until the target server exhausts available memory

The attack is particularly effective because gRPC services are often exposed publicly and the metric collection happens transparently before any application-level authentication occurs.

// Before fix - vulnerable telemetry attribute collection
// Source: interceptor.go - spanInfo function captured peer attributes

// After fix - high cardinality attributes removed
name, attr, _ := telemetryAttributes(method, cc.Target())

startOpts := append([]trace.SpanStartOption{
    trace.WithSpanKind(trace.SpanKindClient),

Source: GitHub Commit Fix

Detection Methods for CVE-2023-47108

Indicators of Compromise

• Unusual memory growth patterns in gRPC services using OpenTelemetry instrumentation
• High cardinality warnings or errors from your metrics backend (Prometheus, etc.)
• Increasing number of unique time series in metric storage systems
• Service degradation or out-of-memory crashes in gRPC server processes

Detection Strategies

• Monitor memory utilization trends for services using otelgrpc instrumentation
• Set up alerts for abnormal time series cardinality growth in metrics backends
• Review gRPC access logs for patterns indicating distributed attack sources
• Implement rate limiting detection on gRPC endpoints to identify flooding attempts

Monitoring Recommendations

• Configure metrics backend cardinality limits and alerting thresholds
• Monitor Go runtime memory statistics (runtime.MemStats) for affected services
• Track the count of unique net.peer.sock.addr and net.peer.sock.port combinations
• Implement network-level monitoring for unusual gRPC traffic patterns from diverse sources

How to Mitigate CVE-2023-47108

Immediate Actions Required

• Upgrade OpenTelemetry-Go Contrib to version 0.46.0 or later immediately
• Audit all Go services using otelgrpc instrumentation for affected versions
• If immediate upgrade is not possible, implement the documented workarounds below
• Monitor affected services closely for signs of memory exhaustion attacks

Patch Information

The vulnerability is fixed in OpenTelemetry-Go Contrib version 0.46.0. The fix removes the high-cardinality net.peer.sock.addr and net.peer.sock.port attributes from the default metric instrumentation. Organizations should update their go.mod dependency to:

go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.46.0

The security fix is documented in GitHub Security Advisory GHSA-8pgv-569h-w5rw and implemented via Pull Request #4322.

Workarounds

• Configure a view that explicitly removes the net.peer.sock.addr and net.peer.sock.port attributes from metrics
• Disable gRPC metrics instrumentation entirely by passing the otelgrpc.WithMeterProvider option with noop.NewMeterProvider
• Implement network-level rate limiting to reduce the effectiveness of flooding attacks
• Configure metrics backend cardinality limits as an additional defense layer

// Workaround: Disable gRPC metrics instrumentation
import (
    "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc"
    "go.opentelemetry.io/otel/metric/noop"
)

// Use noop meter provider to disable metrics collection
opts := []otelgrpc.Option{
    otelgrpc.WithMeterProvider(noop.NewMeterProvider()),
}

Reference: Go.dev New Meter Provider Documentation