CLEANSTART-2026-BK50612: Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D lan...
Security vulnerability affects the jaeger package. Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/jaegerto a version that resolves this vulnerability.Fixed in 2.20.0-r0 - Upgrade
Upgrade
cleanstart/jaegerto a version that resolves this vulnerability.Fixed in 2.21.0-r0 - Upgrade
Upgrade
cleanstart/jaegerto a version that resolves this vulnerability.Fixed in 2.22.0-r1
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vector is network-based, with low attack complexity. The supplied metrics indicate that exploitation does not require privileges or user interaction.
What is the expected security impact?
The supplied metrics indicate a high availability impact, with no indicated impact to confidentiality or integrity. The affected jaeger package may be susceptible to resource exhaustion from excessive memory allocation.