CVE-2026-40894mediumCWE-789

CVE-2026-40894: medium-severity vulnerability in open-telemetry OpenTelemetry.Api

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

Published

Follow this CVE+ Monitor opentelemetry-dotnet+ Monitor OpenTelemetry.Api

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
open-telemetry · OpenTelemetry.Apiopen-telemetry · opentelemetry-dotnetopen-telemetry · OpenTelemetry.Extensions.Propagators
Related CVEs — open-telemetry OpenTelemetry.Api

In the same product, most dangerous first.

CVE-2025-27513HIGHOpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API PackageEPSS 0.5%CVE-2026-41310MEDIUMOpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growthEPSS 0.3%CVE-2026-40182MEDIUMOpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesEPSS 0.3%CVE-2024-32028MEDIUMSensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreEPSS 0.3%CVE-2026-41078MEDIUMOpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion pathEPSS 0.2%CVE-2026-40891MEDIUMOpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingEPSS 0.2%