CVE-2023-43810

CVE-2023-43810 is a denial-of-service vulnerability affecting OpenTelemetry (OTel) versions prior to 0.41b0. It arises from the autoinstrumentation of HTTP handlers, which adds an 'http_method' label with unbound cardinality, allowing an attacker to send numerous malicious requests with random, long HTTP methods. This can lead to server memory exhaustion. The vulnerability has a CVSS score of 7.5 (High), indicating a network-based attack with low complexity, requiring no privileges or user interaction, and resulting in high availability impact. The EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The vulnerability has received minimal community discussion and media coverage.