PT-2026-34707 · Unknown · Opentelemetry Dotnet

1Seal · Published 2026-04-23 · Updated 2026-04-29 · CVE-2026-40182

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry dotnet versions 1.13.1 through 1.15.1

Description When exporting telemetry to a back-end or collector over gRPC or HTTP using the OpenTelemetry Protocol (OTLP) format, unsuccessful requests (HTTP 4xx or 5xx) result in the response being read into memory without an upper bound on the number of bytes consumed. This can lead to memory exhaustion and a denial-of-service condition in the consuming application if the configured back-end or collector endpoint is attacker-controlled or if a network attacker performs a Man-in-the-Middle (MitM) attack to return an extremely large response body.

Recommendations Update to version 1.15.2.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-40182

GHSA-Q834-8QMM-V933

Affected Products

Opentelemetry Dotnet

References · 11

• https://github.com/open-telemetry/opentelemetry-dotnet/pull/6564 · Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7017 · Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-q834-8qmm-v933 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q834-8qmm-v933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40182 · Security Note
• https://github.com/open-telemetry/opentelemetry-dotnet · Note
• https://github.com/open-telemetry/opentelemetry-proto/pull/781 · Note
• https://twitter.com/_cvereports/status/2049063779476922580 · Twitter Post
• https://twitter.com/dailycve/status/2049590011855618461 · Twitter Post
• https://twitter.com/dailycve/status/2047467890140450972 · Twitter Post
• https://twitter.com/CVEnew/status/2047428097889411391 · Twitter Post