CVE-2026-40182
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In OpenTelemetry dotnet from 1.13.1 to before 1.15.2, when exporting telemetry to a back-end/collector over gRPC or HTTP using OTLP, an unsuccessful request (HTTP 4xx or 5xx) causes the response to be read into memory with no upper bound on bytes consumed. This could cause memory exhaustion if the endpoint is attacker-controlled or a MitM is possible and an extremely large body is returned.
Risk Assessment
Memory exhaustion and application failure may occur if an attacker controls the collector endpoint or intercepts the connection. This poses a threat to service availability.
Recommendation
Update OpenTelemetry dotnet to version 1.15.2 or later, which fixes the vulnerability.
Other vulnerabilities in OpenTelemetry dotnet
See all- CVE-2026-40894Medium
OpenTelemetry dotnet is a .NET telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, the baggage, B3 and Jaeger processing implementation can allocate excessive memory when parsing, potentially causing a denial of service (DoS) in the consuming application. The vulnerability is fixed in 1.15.3.
- CVE-2026-40891Medium
OpenTelemetry dotnet versions 1.13.1 to before 1.15.2, when exporting telemetry over gRPC using OTLP, may parse a malformed server-provided grpc-status-details-bin trailer during retry handling. This could encode an extremely large length-delimited protobuf field used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS).
Original NVD description (English source)
OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS