CVE-2026-44902

Executive Summary

CVE-2026-44902 is a high-severity (CVSS 7.5) Denial of Service (DoS) vulnerability in the OpenTelemetry JavaScript client library (opentelemetry-js). The flaw resides in the Prometheus exporter's metrics endpoint, which listens on 0.0.0.0:9464 by default. A single malformed HTTP request with an invalid URI causes an uncaught TypeError during URL parsing, crashing the entire Node.js process. This is a classic unhandled exception leading to process termination. The vulnerability affects all versions prior to 0.217.0. No public exploit code or proof-of-concept is currently available, but the attack vector is trivial to execute.

Supply Chain & Package Security

This vulnerability affects the @opentelemetry/exporter-prometheus package within the opentelemetry-js npm ecosystem. Organizations using this package in production environments are at risk of a complete service outage from a single HTTP request. The package is widely used for exporting metrics to Prometheus, making it a high-value target for attackers seeking to disrupt observability pipelines. The fix is available in version 0.217.0, and immediate upgrade is strongly recommended.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex steps are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The vulnerability causes a complete denial of service.

Threat Level: High. The low attack complexity and lack of required privileges make this a critical risk for any exposed Prometheus metrics endpoint.

Deep Dive & Mechanics

The vulnerability is located in the HTTP request handler for the Prometheus metrics endpoint. When a request is received, the server parses the URL to extract the path. If the URL is malformed (e.g., contains invalid characters or encoding), the URL constructor throws a TypeError. This exception is not caught by any error handler, causing the Node.js process to crash.

Root Cause: The absence of a try-catch block around the URL parsing logic in the request handler.

Attack Vector: An attacker sends a single HTTP request to the metrics endpoint (default port 9464) with a malformed URI, such as:

GET /%00 HTTP/1.1
Host: target:9464

The null byte (%00) or other invalid characters cause the URL parser to fail, triggering the uncaught exception.

Impact: The Node.js process terminates immediately, resulting in a complete loss of the metrics endpoint and any other services running in the same process.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 0.217.0):

// In the HTTP server request handler
server.on('request', (req, res) => {
  const url = new URL(req.url, `http://${req.headers.host}`);
  // ... process request
});

The new URL() call can throw a TypeError if req.url is malformed, and there is no error handling.

Patched Code (0.217.0):

// In the HTTP server request handler
server.on('request', (req, res) => {
  try {
    const url = new URL(req.url, `http://${req.headers.host}`);
    // ... process request
  } catch (err) {
    res.statusCode = 400;
    res.end('Bad Request');
  }
});

The fix wraps the URL parsing in a try-catch block, returning a 400 Bad Request response instead of crashing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running opentelemetry-js with the Prometheus exporter enabled on port 9464.
• Network access to the target.

Exploitation Steps:

1. Identify the target's metrics endpoint (e.g., http://target:9464/metrics).
2. Send a malformed HTTP request using curl or a custom script:

   curl -v --path-as-is 'http://target:9464/%00'
   

   Or using netcat:

   echo -e "GET /%00 HTTP/1.1\r\nHost: target:9464\r\n\r\n" | nc target 9464
   

3. Observe that the target process crashes and the endpoint becomes unavailable.

Lab Setup:

• Use a Docker container running a vulnerable version of opentelemetry-js (e.g., 0.216.0).
• Expose port 9464.
• Run the exploit from a separate container or host.

Blue Team (Defense)

Detection:

• Monitor for HTTP requests with malformed URIs (e.g., containing null bytes, invalid UTF-8, or excessive encoding) to the metrics endpoint.
• Alert on sudden process crashes or restarts of Node.js applications.

Mitigation:

• Immediately upgrade to opentelemetry-js version 0.217.0 or later.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) in front of the metrics endpoint to filter malformed requests:

  location /metrics {
      proxy_pass http://localhost:9464;
      # Reject requests with invalid characters
      if ($request_uri ~* "%00|%ff") {
          return 400;
      }
  }
  

• Restrict network access to the metrics endpoint using firewall rules (e.g., allow only trusted IPs).

Indicators of Compromise (IOCs)

• Network: HTTP requests to port 9464 with malformed URIs (e.g., containing %00, %ff, or other invalid percent-encoded characters).
• Logs: Node.js crash logs showing an uncaught TypeError from the URL constructor.
• Process: Unexpected termination of the Node.js process running the OpenTelemetry exporter.
• File: Core dumps (if enabled) from the crashed Node.js process.

Detection Engineering

YARA Rule

rule CVE_2026_44902_Malformed_URI_Request {
    meta:
        description = "Detects malformed HTTP requests targeting OpenTelemetry Prometheus exporter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-44902"
    strings:
        $uri_null = /GET \/[^\s]*%00[^\s]* HTTP\/1\.\d/
        $uri_invalid = /GET \/[^\s]*%ff[^\s]* HTTP\/1\.\d/
        $uri_bad = /GET \/[^\s]*[\x00-\x08\x0e-\x1f][^\s]* HTTP\/1\.\d/
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-44902 - Malformed URI to OpenTelemetry Prometheus Exporter
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects HTTP requests with malformed URIs targeting the OpenTelemetry Prometheus metrics endpoint (port 9464).
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: generic
detection:
    selection:
        dst_port: 9464
        http_method: 'GET'
        http_uri|contains:
            - '%00'
            - '%ff'
            - '\x00'
            - '\xff'
    condition: selection
falsepositives:
    - Legitimate testing tools
level: high

Suricata Rule

alert http any any -> any 9464 (msg:"CVE-2026-44902 - Malformed URI to OpenTelemetry Prometheus Exporter"; flow:to_server; content:"GET"; http_method; content:"%00"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update @opentelemetry/exporter-prometheus to version 0.217.0 or later.

   npm install @opentelemetry/exporter-prometheus@^0.217.0
   

2. Workaround: If upgrade is not possible, implement a reverse proxy (Nginx, HAProxy) to filter malformed requests before they reach the Node.js process.
3. Network Segmentation: Restrict access to the metrics endpoint to trusted IP addresses only (e.g., monitoring servers).

Long-Term Measures:

• Implement robust error handling in all HTTP request handlers.
• Use a Web Application Firewall (WAF) to block malformed requests.
• Regularly update dependencies and monitor for security advisories.

Valters IT Signature:

Report generated by Valters IT DevSecOps Intelligence. For questions, contact security@valters-it.com.