Memory Exhaustion Risk in OpenTelemetry .NET Framework by OpenTelemetry

CVE-2026-40182

What is CVE-2026-40182?

The OpenTelemetry .NET telemetry framework is susceptible to a memory exhaustion vulnerability when exporting telemetry data to a back-end or collector over gRPC or HTTP, specifically in versions 1.13.1 to 1.15.1. If a request to the back-end endpoint results in an unsuccessful response (HTTP 4xx or 5xx), the application may read the response into memory without restrictions on the amount of data, potentially leading to excessive memory consumption. This issue is particularly concerning when the back-end endpoint is under the control of an attacker or when a MitM (Man-in-the-Middle) attacks the connection, allowing for the possibility of an enormous response body being sent. The vulnerability is mitigated in version 1.15.2.

References