vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2024-32028

Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

MEDIUM
4.1
CVSS Score
Published: April 12, 2024 at 10:58 PM UTC
Updated: June 17, 2026 at 07:29 AM UTC
2 products affected across 1 vendorOpentelemetryOpentelemetry .NET

Using opentelemetry-dotnet by open-telemetry?

Get instant alerts when new vulnerabilities affect opentelemetry-dotnet - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM4.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Opentelemetry· Opentelemetrynuget
60%
v < 1.8.1
Affected range stops below 1.8.1, so it looks safe — our inference, not a vendor statement
Opentelemetry .NET· Opentelemetry
60%
v < 1.8.1
Affected range stops below 1.8.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (3)

x_refsource_MISC
Source: [email protected]
https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42
x_refsource_CONFIRM
Source: [email protected]
https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f
x_refsource_MISC
Source: [email protected]
https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

4.1MEDIUMGitHub_M
Attack Vector
ADJACENT_NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-201CWE-212

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card