PT-2025-9847 · Unknown · Opentelemetry Dotnet

Highrajkumar-Rangaraj · Published 2025-03-05 · Updated 2025-03-06 · CVE-2025-27513

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Api versions 1.10.0 through 1.11.1

Description A vulnerability in OpenTelemetry.Api could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime.

Recommendations To resolve the issue, upgrade to OpenTelemetry.Api version 1.11.2 by running the command dotnet add package OpenTelemetry --version 1.11.2. For OpenTelemetry .NET Automatic Instrumentation, upgrade to version 1.11.0. As a temporary workaround, consider restricting access to the vulnerable OpenTelemetry.Api package until a patch is available. Avoid using the tracestate and traceparent headers in HTTP requests until the issue is resolved.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2025-27513

GHSA-8785-WC3W-H8Q6

GHSA-VC29-VG52-6643

Affected Products

Opentelemetry Dotnet

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27513.json · Exploit
• https://osv.dev/vulnerability/GHSA-vc29-vg52-6643 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27513 · Security Note
• https://osv.dev/vulnerability/GHSA-8785-wc3w-h8q6 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-dotnet · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/commit/1b555c1201413f2f55f2cd3c4ba03ef4b615b6b5 · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-8785-wc3w-h8q6 · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/6161 · Note
• https://github.com/open-telemetry/opentelemetry-dotnet-instrumentation/security/advisories/GHSA-vc29-vg52-6643 · Note
• https://github.com/open-telemetry/opentelemetry-dotnet-instrumentation · Note
• https://t.me/cvedetector/19654 · Telegram Post
• https://twitter.com/CVEnew/status/1897506905615978517 · Twitter Post