CVE-2026-40894 Details
Description
OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.
A denial-of-service vulnerability has been identified in the OpenTelemetry .NET framework, specifically within the OpenTelemetry.Api package versions 0.5.0-beta.2 prior to 1.15.2 and the OpenTelemetry.Extensions.Propagators package versions 1.3.1 prior to 1.15.2. The issue arises from the Baggage, B3, and Jaeger propagation methods, which can allocate excessive memory when parsing propagation headers. This flaw could be exploited to create a potential denial-of-service condition in applications using these packages.
Users can update to OpenTelemetry.Api version 1.15.3 or OpenTelemetry.Extensions.Propagators version 1.15.3, both of which address this vulnerability. Additionally, for those unable to update immediately, configuring HTTP request header limits or disabling baggage and trace propagation can serve as temporary workarounds.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/1048 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/3244 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/3309 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/533 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/7061 | [email protected] | Issue TrackingPatch |
| https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry | >= 0.5.0, < 1.15.3 |
CPE
Remediation
| |
| opentelemetry opentelemetry.api | >= 0.5.0, < 1.15.3 |
CPE
Remediation
| |
| opentelemetry opentelemetry.extensions.propagators | > 1.3.0, < 1.15.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | New CVE Received | [email protected] |