CVE-2026-40891

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-789

Affected software

Vendor	Product	Versions
open-telemetry	opentelemetry-dotnet	>= 1.13.1, < 1.15.3
open-telemetry	OpenTelemetry.Exporter.OpenTelemetryProtocol	>= 1.13.1, < 1.15.3

References

https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980Issue Tracking, Patch
https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064Issue Tracking, Patch
https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8pMitigation, Vendor Advisory

Timeline

Published: Apr 23, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-408929.8PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_CVE-2026-408938.2Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:CVE-2026-408945.3OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1 CVE-2026-408957.5follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to CVE-2026-408967.1OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any p CVE-2026-408978.8Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary J CVE-2026-408987.5quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-CVE-2026-408996.5DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass v CVE-2026-40906.1The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due t CVE-2026-409008.8DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in th CVE-2026-409018.8DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pul CVE-2026-409027.5PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX