open-telemetry opentelemetry-dotnet up to 1.15.2 OpenTelemetry Protocol memory allocation

Summaryinfo

A vulnerability labeled as problematic has been found in open-telemetry opentelemetry-dotnet up to 1.15.2. This affects an unknown function of the component OpenTelemetry Protocol Handler. Such manipulation leads to memory allocation. This vulnerability is referenced as CVE-2026-40891. The attack needs to be initiated within the local network. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in open-telemetry opentelemetry-dotnet up to 1.15.2. It has been rated as problematic. Affected by this issue is an unknown part of the component OpenTelemetry Protocol Handler. The manipulation with an unknown input leads to a memory allocation vulnerability. Using CWE to declare the problem leads to CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. Impacted is availability. CVE summarizes:

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-40891 since 04/15/2026. The exploitation is known to be difficult. The attack needs to be done within the local network. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 1.15.3 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25268). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• open-telemetry

Name

• opentelemetry-dotnet

Version

• 1.15.0
• 1.15.1
• 1.15.2

Website

• Product: https://github.com/open-telemetry/opentelemetry-dotnet/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion