{
  "cveId": "CVE-2024-36129",
  "url": "https://patchblox.com/security/cve/CVE-2024-36129",
  "summary": "CVE-2024-36129 is fixed in amazon-cloudwatch-agent on 1 platform by ALAS2023-2024-708 (version 1.300044.0-1.amzn2023), released August 28, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "amazon-cloudwatch-agent: The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data",
  "description": "The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.",
  "published": "2024-08-28T20:03:00Z",
  "severity": "important",
  "epss": 0.01242,
  "epssPercentile": 0.6945,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "amazon-cloudwatch-agent",
      "release": "amzn 2023",
      "fixedVersion": "1.300044.0-1.amzn2023",
      "fix": "ALAS2023-2024-708",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2024-708",
      "released": "2024-08-28T20:03:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-11T01:43:54Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}