CVE-2026-41483 — OpenTelemetry.Resources.Azure is the .NET resource detector

title: Unbounded Heap Allocation via Azure VM Metadata Service - CVE-2026-41483
id: scw-2026-05-06-ai-1
status: experimental
level: high
description: |
  Detects HTTP requests to the Azure VM instance metadata service endpoint, which is targeted by CVE-2026-41483. An attacker controlling this endpoint or performing a MiTM attack can return an arbitrarily large response, leading to unbounded heap allocation and potential process termination. This rule specifically looks for requests to the metadata service, a key indicator of the vulnerability being exploited.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41483/
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/metadata/instance'
      sc-status:
          - '200'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse