CVE-2026-40891 Details
Description
OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.
A denial-of-service vulnerability has been identified in the OpenTelemetry .NET exporter when exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP). This issue affects versions 1.13.1 prior to 1.15.2. The vulnerability arises during the retry handling of server-provided 'grpc-status-details-bin' trailers. A malformed trailer could encode an excessively large length-delimited protobuf field, which was directly used for memory allocation. This allowed for excessive memory usage, potentially leading to process instability or a crash.
Users can upgrade to OpenTelemetry .NET version 1.15.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry | >= 1.13.1, < 1.15.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | New CVE Received | [email protected] |