OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
Priority LOW 30CWE-789Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-789.
Summary
OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00458 39th percentileScored 2026-11-07
Fix Fixed opentelemetry-dotnet (open-telemetry): 1.15.3OpenTelemetry.Api (open-telemetry): 1.15.3+3 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-dotnet | 0.5.0-beta.2 to before 1.15.3 | 1.15.3 | Patch available | CNA |
| open-telemetry | OpenTelemetry.Api | 0.5.0-beta.2 to before 1.15.3 | 1.15.3 | Patch available | CNA |
| open-telemetry | OpenTelemetry.Extensions.Propagators | 1.3.1 to before 1.15.3 | 1.15.3 | Patch available | CNA |
| — | OpenTelemetry.Api (NuGet) | 0.5.0-beta.2 to before 1.15.3 | 1.15.3 | Patch available | GHSA-g94r-2vxg-569j |
| — | OpenTelemetry.Extensions.Propagators (NuGet) | 1.3.1 to before 1.15.3 | 1.15.3 | Patch available | GHSA-g94r-2vxg-569j |
- opentelemetry-dotnet Vendoropen-telemetry Affected 0.5.0-beta.2 to before 1.15.3 Fixed in 1.15.3 Patch available CNA
- OpenTelemetry.Api Vendoropen-telemetry Affected 0.5.0-beta.2 to before 1.15.3 Fixed in 1.15.3 Patch available CNA
- OpenTelemetry.Extensions.Propagators Vendoropen-telemetry Affected 1.3.1 to before 1.15.3 Fixed in 1.15.3 Patch available CNA
- OpenTelemetry.Api (NuGet) Vendor— Affected 0.5.0-beta.2 to before 1.15.3 Fixed in 1.15.3 Patch available GHSA-g94r-2vxg-569j
- OpenTelemetry.Extensions.Propagators (NuGet) Vendor— Affected 1.3.1 to before 1.15.3 Fixed in 1.15.3 Patch available GHSA-g94r-2vxg-569j
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:* | 0.5.0 to before 1.15.3 | Vulnerable | open-telemetry |
| cpe:2.3:a:opentelemetry:opentelemetry.api:*:*:*:*:*:.net:*:* | 0.5.0 to before 1.15.3 | Vulnerable | open-telemetry |
| cpe:2.3:a:opentelemetry:opentelemetry.extensions.propagators:*:*:*:*:*:*:*:* | after 1.3.0, before 1.15.3 | Vulnerable | open-telemetry |
- cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:* Versions 0.5.0 to before 1.15.3 Vulnerable ·open-telemetry
- cpe:2.3:a:opentelemetry:opentelemetry.api:*:*:*:*:*:.net:*:* Versions 0.5.0 to before 1.15.3 Vulnerable ·open-telemetry
- cpe:2.3:a:opentelemetry:opentelemetry.extensions.propagators:*:*:*:*:*:*:*:* Versions after 1.3.0, before 1.15.3 Vulnerable ·open-telemetry
Remediation
- Fix · CNA opentelemetry-dotnet (open-telemetry) Fixed in 1.15.3
- Fix · CNA OpenTelemetry.Api (open-telemetry) Fixed in 1.15.3
- Fix · CNA OpenTelemetry.Extensions.Propagators (open-telemetry) Fixed in 1.15.3
- Fix · GHSA-g94r-2vxg-569j OpenTelemetry.Api (NuGet) Fixed in 1.15.3 Advisory →
- Fix · GHSA-g94r-2vxg-569j OpenTelemetry.Extensions.Propagators (NuGet) Fixed in 1.15.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40894
- 2026-10-03 Alias added: GHSA-g94r-2vxg-569j
References
Patch 5
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/1048
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/3244
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/3309
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/533
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/7061
Advisory 2
More open-telemetry Opentelemetry vulnerabilities
- TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
- TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
- TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
- TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
- TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
- TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
Sources
- CVE-2026-40894 · CVE Program
- CVE-2026-40894 · NVD
- FIRST EPSS
- GHSA-g94r-2vxg-569j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences