Skip to content
Sign in
5.3 Medium

CVE-2026-40891 OpenTelemetry dotnet is a dotnet telemetry framework

Description

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

Affected products and versions

Product Affected versions Fixed in
opentelemetry-dotnet 1.13 1.13.1 → < 1.15.3 1.15.3
OpenTelemetry.Exporter.OpenTelemetryProtocol 1.13 1.13.1 → < 1.15.3 1.15.3

Other CVEs of opentelemetry-dotnet

The 8 CVEs of opentelemetry-dotnet →
CVE-2026-42191 OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation 6.5 Medium CVE-2026-41310 OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry 5.3 Medium CVE-2026-41078 OpenTelemetry dotnet is a dotnet telemetry framework 5.9 Medium CVE-2026-40894 OpenTelemetry dotnet is a dotnet telemetry framework 5.3 Medium
Track this CVE