CVE-2026-40891
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
OpenTelemetry dotnet versions 1.13.1 to before 1.15.2, when exporting telemetry over gRPC using OTLP, may parse a malformed server-provided grpc-status-details-bin trailer during retry handling. This could encode an extremely large length-delimited protobuf field used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS).
Risk Assessment
A malicious or compromised telemetry collector server could cause memory exhaustion in the application, leading to service unavailability.
Recommendation
Update OpenTelemetry dotnet to version 1.15.2 or later.
Other vulnerabilities in OpenTelemetry dotnet
See all- CVE-2026-40894Medium
OpenTelemetry dotnet is a .NET telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, the baggage, B3 and Jaeger processing implementation can allocate excessive memory when parsing, potentially causing a denial of service (DoS) in the consuming application. The vulnerability is fixed in 1.15.3.
- CVE-2026-40182Medium
In OpenTelemetry dotnet from 1.13.1 to before 1.15.2, when exporting telemetry to a back-end/collector over gRPC or HTTP using OTLP, an unsuccessful request (HTTP 4xx or 5xx) causes the response to be read into memory with no upper bound on bytes consumed. This could cause memory exhaustion if the endpoint is attacker-controlled or a MitM is possible and an extremely large body is returned.
Original NVD description (English source)
OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS