OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path
Priority LOW 26CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00222 12th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-dotnet | up to 1.6.0-rc.1 | — | No fix listed | CNA |
| open-telemetry | OpenTelemetry.Exporter.Jaeger | up to 1.6.0-rc.1 | — | No fix listed | CNA |
| — | OpenTelemetry.Exporter.Jaeger (NuGet) | up to 1.6.0-rc.1 | — | No fix listed | GHSA-38h3-2333-qx47 |
- opentelemetry-dotnet Vendoropen-telemetry Affected up to 1.6.0-rc.1 Fixed in — No fix listed CNA
- OpenTelemetry.Exporter.Jaeger Vendoropen-telemetry Affected up to 1.6.0-rc.1 Fixed in — No fix listed CNA
- OpenTelemetry.Exporter.Jaeger (NuGet) Vendor— Affected up to 1.6.0-rc.1 Fixed in — No fix listed GHSA-38h3-2333-qx47
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:* | before 1.6.0 | Vulnerable | open-telemetry |
| cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:alpha1:*:*:*:.net:*:* | 1.6.0 alpha1 | Vulnerable | open-telemetry |
| cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta1:*:*:*:.net:*:* | 1.6.0 beta1 | Vulnerable | open-telemetry |
| cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta2:*:*:*:.net:*:* | 1.6.0 beta2 | Vulnerable | open-telemetry |
| cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta3:*:*:*:.net:*:* | 1.6.0 beta3 | Vulnerable | open-telemetry |
| cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:rc1:*:*:*:.net:*:* | 1.6.0 rc1 | Vulnerable | open-telemetry |
- cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:* Versions before 1.6.0 Vulnerable ·open-telemetry
- cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:alpha1:*:*:*:.net:*:* Versions 1.6.0 alpha1 Vulnerable ·open-telemetry
- cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta1:*:*:*:.net:*:* Versions 1.6.0 beta1 Vulnerable ·open-telemetry
- cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta2:*:*:*:.net:*:* Versions 1.6.0 beta2 Vulnerable ·open-telemetry
- cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta3:*:*:*:.net:*:* Versions 1.6.0 beta3 Vulnerable ·open-telemetry
- cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:rc1:*:*:*:.net:*:* Versions 1.6.0 rc1 Vulnerable ·open-telemetry
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-41078
- 2026-10-03 Alias added: GHSA-38h3-2333-qx47
References
More open-telemetry Opentelemetry vulnerabilities
- TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
- TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
- TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
- TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
- TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
- TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
Sources
- CVE-2026-41078 · CVE Program
- CVE-2026-41078 · NVD
- FIRST EPSS
- GHSA-38h3-2333-qx47 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences