PT-2026-34708 · Unknown · Opentelemetry Dotnet

Arminru + 1 · Published 2026-04-23 · Updated 2026-05-31 · CVE-2026-40891

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry dotnet versions 1.13.1 through 1.15.1

Description When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. A malformed trailer can encode an extremely large length-delimited protobuf field (a method of serializing structured data) which is used directly for allocation. This occurs because the DecodeBytes() function in GrpcStatusDeserializer decodes a protobuf varint length and allocates a byte array without validating the bounds against the remaining payload size. A malicious or compromised collector, or a man-in-the-middle attacker, could return a crafted payload to force oversized memory allocation, leading to memory exhaustion and a potential denial of service (DoS) causing process instability or crashes.

Recommendations Update to version 1.15.2.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-40891

GHSA-MR8R-92FQ-PJ8P

Affected Products

Opentelemetry Dotnet

References · 10

• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980 · Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40891 · Security Note
• https://osv.dev/vulnerability/GHSA-mr8r-92fq-pj8p · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-dotnet · Note
• https://twitter.com/CVEnew/status/2047428095024701695 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1sug4za/resumen_diario_de_vulnerabilidades_24042026 · Reddit Post
• https://twitter.com/_cvereports/status/2049063773478982105 · Twitter Post
• https://twitter.com/yottajunaid/status/2060895477240139813 · Twitter Post