CVE-2026-40894CWE-789

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

Medium · published April 23, 2026

CVSS v3.1
5.3
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00568 · 46.3th percentile
Weakness
CWE-789 · Memory Allocation with Excessive Size Value
Published
2026-04-23T18:03Z
EPSS history
Timeline
  • 23 APR 18:03Z
    OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
    cvelistv5