CVE-2026-41310 Details
Description
OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios, a process using Zipkin export for client or producer spans could experience avoidable memory growth under sustained unique remote endpoint values, increasing process memory usage over time and degrading availability. This issue is fixed in version 1.15.3, which introduces a bounded, thread-safe LRU cache for remote endpoints with a fixed maximum size.
A memory management vulnerability exists in the OpenTelemetry.Exporter.Zipkin package for .NET, specifically in versions through 1.15.2. The issue arises from the remote endpoint cache, which allows unbounded key growth based on span attributes. In scenarios with high cardinality, this can lead to excessive memory consumption over time, particularly when unique remote endpoint values are sustained. As a result, processes using the Zipkin exporter for client or producer spans may experience degraded performance and availability.
Users can upgrade to OpenTelemetry.Exporter.Zipkin version 1.15.3 or later, which includes a bounded, thread-safe LRU cache for remote endpoints with a fixed maximum size, preventing unbounded growth.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-dotnet/pull/7081 | [email protected] | Issue Tracking |
| https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-88hf-wf7h-7w4m | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry.exporter.zipkin | < 1.15.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 11, 2026 | Initial Analysis | [email protected] |
| May 6, 2026 | New CVE Received | [email protected] |