Report

GHSA-rcjv-mgp8-qvmr

OpenTelemetry-Go Contrib has a handler wrapper otelhttp that adds the following labels by deafult that have unbound cardinality:

http.user_agent
http.method

This leads to the server's potential memory exhaustion when many malicious requests are sent to it.