TI-2026-29547 Aliases CVE-2026-40891 GHSA-mr8r-92fq-pj8p

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

LOW 23CWE-789Published 2026-04-23 · Updated 2026-04-23

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00192 8th percentileScored 2026-11-07

Fix Fixed opentelemetry-dotnet (open-telemetry): 1.15.3OpenTelemetry.Exporter.OpenTelemetryProtocol (open-telemetry): 1.15.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-telemetry	opentelemetry-dotnet	1.13.1 to before 1.15.3	1.15.3	Patch available	CNA
open-telemetry	OpenTelemetry.Exporter.OpenTelemetryProtocol	1.13.1 to before 1.15.3	1.15.3	Patch available	CNA
—	OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet)	1.13.1 to before 1.15.3	1.15.3	Patch available	GHSA-mr8r-92fq-pj8p

opentelemetry-dotnet Vendoropen-telemetry Affected 1.13.1 to before 1.15.3 Fixed in 1.15.3 Patch available CNA
OpenTelemetry.Exporter.OpenTelemetryProtocol Vendoropen-telemetry Affected 1.13.1 to before 1.15.3 Fixed in 1.15.3 Patch available CNA
OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) Vendor— Affected 1.13.1 to before 1.15.3 Fixed in 1.15.3 Patch available GHSA-mr8r-92fq-pj8p

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opentelemetry:opentelemetry::::::.net::*	1.13.1 to before 1.15.3	Vulnerable	open-telemetry

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:* Versions 1.13.1 to before 1.15.3 Vulnerable ·open-telemetry

Remediation

Fix · CNA opentelemetry-dotnet (open-telemetry) Fixed in 1.15.3
Fix · CNA OpenTelemetry.Exporter.OpenTelemetryProtocol (open-telemetry) Fixed in 1.15.3
Fix · GHSA-mr8r-92fq-pj8p OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) Fixed in 1.15.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-40891
2026-10-03 Alias added: GHSA-mr8r-92fq-pj8p

References

Patch 2

Advisory 2

Other 1

https://github.com/open-telemetry/opentelemetry-dotnet

TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences