chore:upgrage OPAL to 0.9.6 by dshoen619 · Pull Request #312 · permitio/PDP

dshoen619 · 2026-05-13T09:02:19Z

No description provided.

github-actions · 2026-05-13T09:22:16Z

🔍 Vulnerabilities of `permitio/pdp-v2:next`

📦 Image Reference permitio/pdp-v2:next

digest	`sha256:57b2367b73198c21c31e1e98ce0ce12a32d664ddaddf19378639d4ffc0ecab85`
vulnerabilities
platform	linux/amd64
size	214 MB
packages	252

📦 Base Image python:3.10-alpine3.22

also known as	`3.10.20-alpine3.22`
digest	`sha256:c8f94b3bb77e6ea9015ccd091b7f8aec1b1fcbca95159675235d9a93788797cd`
vulnerabilities

sqlite 3.49.2-r1 (apk)

pkg:apk/alpine/sqlite@3.49.2-r1?os_name=alpine&os_version=3.22

Affected range	`<=3.49.2-r1`
Fixed version	Not Fixed
EPSS Score	`0.050%`
EPSS Percentile	`15th percentile`

Description

go.opentelemetry.io/otel/sdk 1.42.0 (golang)

pkg:golang/go.opentelemetry.io/otel/sdk@1.42.0

Untrusted Search Path

Affected range	`>=1.15.0 <=1.42.0`
Fixed version	`1.43.0`
CVSS Score	`7.3`
CVSS Vector	`CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
EPSS Score	`0.009%`
EPSS Percentile	`1st percentile`

Description

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:
if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {
Compare with the fixed Darwin path at line 58:
result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")
The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk

Attacker places a malicious kenv binary earlier in $PATH

Application initializes OpenTelemetry resource detection at startup

hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary

Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:
if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {
On FreeBSD, kenv is located at /bin/kenv.

golang.org/x/net 0.52.0 (golang)

pkg:golang/golang.org/x/net@0.52.0

Affected range	`<0.53.0`
Fixed version	`0.53.0`
EPSS Score	`0.019%`
EPSS Percentile	`5th percentile`

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

busybox 1.37.0-r20 (apk)

pkg:apk/alpine/busybox@1.37.0-r20?os_name=alpine&os_version=3.22

Affected range	`<=1.37.0-r20`
Fixed version	Not Fixed
EPSS Score	`0.051%`
EPSS Percentile	`16th percentile`

Description

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.42.0 (golang)

pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@1.42.0

Memory Allocation with Excessive Size Value

Affected range	`<1.43.0`
Fixed version	`1.43.0`
CVSS Score	`5.3`
CVSS Vector	`CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
EPSS Score	`0.007%`
EPSS Percentile	`1st percentile`

Description

overview:
this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.

this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).

severity

HIGH

not claiming: this is a remote dos against every default deployment.
claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.

callsite (pinned):

exporters/otlp/otlptrace/otlptracehttp/client.go:199

exporters/otlp/otlptrace/otlptracehttp/client.go:230

exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170

exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201

exporters/otlp/otlplog/otlploghttp/client.go:190

exporters/otlp/otlplog/otlploghttp/client.go:221

permalinks (pinned):

https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199

https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230

https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170

https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L201

https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L190

https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L221

root cause:
each exporter client reads resp.Body using io.Copy(&respData, resp.Body) into a bytes.Buffer on both success and error paths, with no upper bound.

impact:
a malicious collector can force large transient heap allocations during export (peak memory scales with attacker-chosen response size) and can potentially crash the instrumented process (oom).

affected component:

go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp

go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp

repro (local-only):
unzip poc.zip -d poc
cd poc
make canonical resp_bytes=33554432 chunk_delay_ms=0
expected output contains:
[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[PROOF_MARKER]: resp_bytes=33554432 peak_alloc_bytes=118050512
control (same env, patched target):
unzip poc.zip -d poc
cd poc
make control resp_bytes=33554432 chunk_delay_ms=0
expected control output contains:
[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[NC_MARKER]: resp_bytes=33554432 peak_alloc_bytes=512232
attachments: poc.zip (attached)

PR_DESCRIPTION.md

attack_scenario.md

poc.zip

Fixed in: open-telemetry/opentelemetry-go#8108

util-linux 2.41-r9 (apk)

pkg:apk/alpine/util-linux@2.41-r9?os_name=alpine&os_version=3.22

Affected range	`<=2.41-r9`
Fixed version	Not Fixed
EPSS Score	`0.017%`
EPSS Percentile	`4th percentile`

Description

sqlparse 0.5.0 (pypi)

pkg:pypi/sqlparse@0.5.0

Allocation of Resources Without Limits or Throttling

Affected range	`<=0.5.3`
Fixed version	`0.5.4`
CVSS Score	`6.9`
CVSS Vector	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N`

Description

Summary

The below gist hangs while attempting to format a long list of tuples.

This was found while drafting a regression test for Dja
ngo 5.2's composite primary key feature, which allows querying composite fields with tuples.

github-actions · 2026-05-13T09:22:19Z

🔍 Vulnerabilities of `permitio/pdp-v2:next`

📦 Image Reference permitio/pdp-v2:next

digest	`sha256:57b2367b73198c21c31e1e98ce0ce12a32d664ddaddf19378639d4ffc0ecab85`
vulnerabilities
platform	linux/amd64
size	214 MB
packages	252

📦 Base Image python:3.10-alpine3.22

also known as	`3.10.20-alpine3.22`
digest	`sha256:c8f94b3bb77e6ea9015ccd091b7f8aec1b1fcbca95159675235d9a93788797cd`
vulnerabilities

go.opentelemetry.io/otel/sdk 1.42.0 (golang)

pkg:golang/go.opentelemetry.io/otel/sdk@1.42.0

Untrusted Search Path

Affected range	`>=1.15.0 <=1.42.0`
Fixed version	`1.43.0`
CVSS Score	`7.3`
CVSS Vector	`CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
EPSS Score	`0.009%`
EPSS Percentile	`1st percentile`

Description

Summary

The fix for GHSA-9h8m-3fm2-qjrq (CVE-2026-24051) changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

Root Cause

sdk/resource/host_id.go line 42:
if result, err := r.execCommand("kenv", "-q", "smbios.system.uuid"); err == nil {
Compare with the fixed Darwin path at line 58:
result, err := r.execCommand("/usr/sbin/ioreg", "-rd1", "-c", "IOPlatformExpertDevice")
The execCommand helper at sdk/resource/host_id_exec.go uses exec.Command(name, arg...) which searches $PATH when the command name contains no path separator.

Affected platforms (per build tag in host_id_bsd.go:4): DragonFly BSD, FreeBSD, NetBSD, OpenBSD, Solaris.

The kenv path is reached when /etc/hostid does not exist (line 38-40), which is common on FreeBSD systems.

Attack

Attacker has local access to a system running a Go application that imports go.opentelemetry.io/otel/sdk

Attacker places a malicious kenv binary earlier in $PATH

Application initializes OpenTelemetry resource detection at startup

hostIDReaderBSD.read() calls exec.Command("kenv", ...) which resolves to the malicious binary

Arbitrary code executes in the context of the application

Same attack vector and impact as CVE-2026-24051.

Suggested Fix

Use the absolute path:
if result, err := r.execCommand("/bin/kenv", "-q", "smbios.system.uuid"); err == nil {
On FreeBSD, kenv is located at /bin/kenv.

golang.org/x/net 0.52.0 (golang)

pkg:golang/golang.org/x/net@0.52.0

Affected range	`<0.53.0`
Fixed version	`0.53.0`
EPSS Score	`0.019%`
EPSS Percentile	`5th percentile`

Description

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

sqlite 3.49.2-r1 (apk)

pkg:apk/alpine/sqlite@3.49.2-r1?os_name=alpine&os_version=3.22

Affected range	`<=3.49.2-r1`
Fixed version	Not Fixed
EPSS Score	`0.050%`
EPSS Percentile	`15th percentile`

Description

chore:upgrage OPAL to 0.9.6

f58cb29

dshoen619 closed this May 13, 2026

dshoen619 deleted the 0.9.13 branch May 13, 2026 10:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore:upgrage OPAL to 0.9.6#312

chore:upgrage OPAL to 0.9.6#312
dshoen619 wants to merge 1 commit into
mainfrom
0.9.13

dshoen619 commented May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026

Summary

Root Cause

Attack

Suggested Fix

Summary

Uh oh!

github-actions Bot commented May 13, 2026

Summary

Root Cause

Attack

Suggested Fix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dshoen619 commented May 13, 2026

Uh oh!

github-actions Bot commented May 13, 2026

🔍 Vulnerabilities of permitio/pdp-v2:next

Summary

Root Cause

Attack

Suggested Fix

Summary

Uh oh!

github-actions Bot commented May 13, 2026

🔍 Vulnerabilities of permitio/pdp-v2:next

Summary

Root Cause

Attack

Suggested Fix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

🔍 Vulnerabilities of `permitio/pdp-v2:next`

🔍 Vulnerabilities of `permitio/pdp-v2:next`