Read the docs
TI-2026-28996 Aliases CVE-2026-40182GHSA-q834-8qmm-v933

OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

Priority LOW 26CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Fix Fixed opentelemetry-dotnet (open-telemetry): 1.15.2OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet): 1.15.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-dotnet1.13.1 to before 1.15.21.15.2Patch availableCNA
—OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet)1.13.1 to before 1.15.21.15.2Patch availableGHSA-q834-8qmm-v933
  • opentelemetry-dotnet Vendoropen-telemetry Affected 1.13.1 to before 1.15.2 Fixed in 1.15.2 Patch available CNA
  • OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) Vendor— Affected 1.13.1 to before 1.15.2 Fixed in 1.15.2 Patch available GHSA-q834-8qmm-v933

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*1.13.1 to before 1.15.2Vulnerableopen-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:* Versions 1.13.1 to before 1.15.2 Vulnerable ·open-telemetry

Remediation

  • Fix · CNA opentelemetry-dotnet (open-telemetry) Fixed in 1.15.2
  • Fix · GHSA-q834-8qmm-v933 OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) Fixed in 1.15.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40182
  2. 2026-10-03 Alias added: GHSA-q834-8qmm-v933

References

Patch 2

Advisory 2

Other 2

  • TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
  • TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
  • TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
  • TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences