CVE-2026-40891

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980	Issue Tracking Patch
https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064	Issue Tracking Patch
https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) OpenTelemetry dotnet es un framework de telemetría dotnet. Desde 1.13.1 hasta antes de 1.15.2, al exportar telemetría a través de gRPC utilizando el Protocolo OpenTelemetry (OTLP), el exportador puede analizar un tráiler grpc-status-details-bin proporcionado por el servidor durante el manejo de reintentos. Antes de la corrección, un tráiler malformado podría codificar un campo protobuf delimitado por longitud extremadamente grande que se utilizaba directamente para la asignación, permitiendo una asignación de memoria excesiva y una potencial denegación de servicio (DoS). Esta vulnerabilidad está corregida en 1.15.2.

Information

Published : 2026-04-23 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40891

Mitre link : CVE-2026-40891

CVE.ORG link : CVE-2026-40891

JSON object : View

Products Affected

opentelemetry

opentelemetry

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-40891", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40891", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-23T18:22:43.489569Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-dotnet", "versions": [{"status": "affected", "version": ">= 1.13.1, < 1.15.3"}]}, {"vendor": "open-telemetry", "product": "OpenTelemetry.Exporter.OpenTelemetryProtocol", "versions": [{"status": "affected", "version": ">= 1.13.1, < 1.15.3"}]}]}], "published": "2026-04-23T18:16:28.483", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2."}, {"lang": "es", "value": "OpenTelemetry dotnet es un framework de telemetr\u00eda dotnet. Desde 1.13.1 hasta antes de 1.15.2, al exportar telemetr\u00eda a trav\u00e9s de gRPC utilizando el Protocolo OpenTelemetry (OTLP), el exportador puede analizar un tr\u00e1iler grpc-status-details-bin proporcionado por el servidor durante el manejo de reintentos. Antes de la correcci\u00f3n, un tr\u00e1iler malformado podr\u00eda codificar un campo protobuf delimitado por longitud extremadamente grande que se utilizaba directamente para la asignaci\u00f3n, permitiendo una asignaci\u00f3n de memoria excesiva y una potencial denegaci\u00f3n de servicio (DoS). Esta vulnerabilidad est\u00e1 corregida en 1.15.2."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*", "vulnerable": true, "matchCriteriaId": "9BACBB49-0AF7-4FB3-AAFB-1C9AB3E43F60", "versionEndExcluding": "1.15.3", "versionStartIncluding": "1.13.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}