OpenTelemetry dotnet vulnerabilities

OpenTelemetry dotnet is a .NET telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, the baggage, B3 and Jaeger processing implementation can allocate excessive memory when parsing, potentially causing a denial of service (DoS) in the consuming application. The vulnerability is fixed in 1.15.3.

OpenTelemetry dotnet versions 1.13.1 to before 1.15.2, when exporting telemetry over gRPC using OTLP, may parse a malformed server-provided grpc-status-details-bin trailer during retry handling. This could encode an extremely large length-delimited protobuf field used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS).

In OpenTelemetry dotnet from 1.13.1 to before 1.15.2, when exporting telemetry to a back-end/collector over gRPC or HTTP using OTLP, an unsuccessful request (HTTP 4xx or 5xx) causes the response to be read into memory with no upper bound on bytes consumed. This could cause memory exhaustion if the endpoint is attacker-controlled or a MitM is possible and an extremely large body is returned.