CVE-2026-41078 Details
Description
OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.
A vulnerability in the OpenTelemetry .NET Jaeger exporter, present in versions through 1.6.0-rc.1, can lead to sustained memory pressure. This occurs when the internal pooled-list sizing increases based on large observed span or tag sets, and the enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this behavior can escalate memory consumption, potentially causing a denial-of-service condition. The issue arises because the Jaeger exporter appends tag and event data into pooled list structures, which can be influenced by untrusted input, leading to process instability.
Users are advised to switch to maintained exporters, such as the OpenTelemetry Protocol format (OTLP) exporter, instead of the Jaeger exporter.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry | < 1.6.0 1.6.0 alpha1 1.6.0 beta1 1.6.0 beta2 1.6.0 beta3 1.6.0 rc1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 23, 2026 | New CVE Received | [email protected] |