CVE-2026-40894
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
OpenTelemetry dotnet is a .NET telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, the baggage, B3 and Jaeger processing implementation can allocate excessive memory when parsing, potentially causing a denial of service (DoS) in the consuming application. The vulnerability is fixed in 1.15.3.
Risk Assessment
An attacker could supply specially crafted propagation data, causing excessive memory allocation and resource exhaustion, leading to denial of service. The risk affects .NET applications using vulnerable OpenTelemetry packages.
Recommendation
Upgrade OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators to version 1.15.3 or later. Consider limiting the size of processed propagation data as a temporary mitigation.
Other vulnerabilities in OpenTelemetry dotnet
See all- CVE-2026-40891Medium
OpenTelemetry dotnet versions 1.13.1 to before 1.15.2, when exporting telemetry over gRPC using OTLP, may parse a malformed server-provided grpc-status-details-bin trailer during retry handling. This could encode an extremely large length-delimited protobuf field used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS).
- CVE-2026-40182Medium
In OpenTelemetry dotnet from 1.13.1 to before 1.15.2, when exporting telemetry to a back-end/collector over gRPC or HTTP using OTLP, an unsuccessful request (HTTP 4xx or 5xx) causes the response to be read into memory with no upper bound on bytes consumed. This could cause memory exhaustion if the endpoint is attacker-controlled or a MitM is possible and an extremely large body is returned.
Original NVD description (English source)
OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS