open-telemetry opentelemetry-dotnet up to 1.15.2 OpenTelemetry.Api memory allocation

Summaryinfo

A vulnerability has been found in open-telemetry opentelemetry-dotnet, OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators up to 1.15.2 and classified as problematic. This issue affects some unknown processing of the component OpenTelemetry.Api/OpenTelemetry.Extensions.Propagators. Performing a manipulation results in memory allocation. This vulnerability is reported as CVE-2026-40894. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in open-telemetry opentelemetry-dotnet, OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators up to 1.15.2. It has been classified as problematic. This affects an unknown part of the component OpenTelemetry.Api/OpenTelemetry.Extensions.Propagators. The manipulation with an unknown input leads to a memory allocation vulnerability. CWE is classifying the issue as CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. This is going to have an impact on availability. The summary by CVE is:

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-40894 since 04/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 1.15.3 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-25269). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• open-telemetry

Name

• opentelemetry-dotnet
• OpenTelemetry.Api
• OpenTelemetry.Extensions.Propagators

Version

• 1.15.0
• 1.15.1
• 1.15.2

Website

• Product: https://github.com/open-telemetry/opentelemetry-dotnet/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion