Denial of Service Vulnerability in OpenTelemetry .NET Framework by OpenTelemetry
CVE-2026-40891
5.3MEDIUM
What is CVE-2026-40891?
In the OpenTelemetry .NET telemetry framework, versions ranging from 1.13.1 up to, but not including, 1.15.2 are affected by a vulnerability related to the gRPC exporter handling server-provided grpc-status-details-bin trailers during telemetry exports. Specifically, if a malformed trailer is encountered, it could result in excessive memory allocation due to an extremely large length-delimited protobuf field being decoded directly. This condition creates a pathway for potential denial of service attacks, impacting application availability. Users are advised to upgrade to version 1.15.2 or later to mitigate this issue.
Affected Version(s)
opentelemetry-dotnet >= 1.13.1, < 1.15.3
OpenTelemetry.Exporter.OpenTelemetryProtocol >= 1.13.1, < 1.15.3