CyberRota Analysis
AI-GeneratedThe vulnerability affects the OpenTelemetry JavaScript client, specifically the @opentelemetry/propagator-jaeger component, which improperly decodes certain HTTP header values, leading to an uncaught URIError that can crash a Node.js process. This flaw allows unauthenticated remote attackers to exploit the system by sending malformed percent-encoded values. Organizations using versions prior to 2.9.0 should prioritize updating to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.