Skip to content
fr Sign in
5.3 Medium

CVE-2026-40182 OpenTelemetry dotnet is a dotnet telemetry framework

Description

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2.

Affected products and versions

Product Affected versions Fixed in
opentelemetry-dotnet 1.13 1.13.1 → < 1.15.2 1.15.2

References

Timeline

  1. Published
  2. Last modified

Other CVEs of opentelemetry-dotnet

The 8 CVEs of opentelemetry-dotnet →
CVE-2026-42191 OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation 6.5 Medium CVE-2026-41310 OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry 5.3 Medium CVE-2026-41078 OpenTelemetry dotnet is a dotnet telemetry framework 5.9 Medium CVE-2026-40894 OpenTelemetry dotnet is a dotnet telemetry framework 5.3 Medium
Track this CVE