CVE-2026-41310: fallo de gravedad media en open-telemetry opentelemetry-dotnet
OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.3%
OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios, a process using Zipkin export for client or producer spans could experience avoidable memory growth under sustained unique remote endpoint values, increasing process memory usage over time and degrading availability. This issue is fixed in version 1.15.3, which introduces a bounded, thread-safe LRU cache for remote endpoints with a fixed maximum size.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
open-telemetry · opentelemetry-dotnetCVEs relacionadas — open-telemetry opentelemetry-dotnet
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-27513HIGHOpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API PackageEPSS 0.5%CVE-2026-40894MEDIUMOpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersEPSS 0.5%CVE-2026-40182MEDIUMOpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesEPSS 0.3%CVE-2024-32028MEDIUMSensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreEPSS 0.3%CVE-2026-41078MEDIUMOpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion pathEPSS 0.2%CVE-2026-40891MEDIUMOpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingEPSS 0.2%