PT-2026-34720 · Nuget · Opentelemetry Api+1

Arminru + 2 · Published 2026-04-23 · Updated 2026-05-11 · CVE-2026-40894

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Api versions 0.5.0-beta.2 through 1.15.2 OpenTelemetry.Extensions.Propagators versions 1.3.1 through 1.15.2

Description Implementation details of the baggage, B3, and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory during parsing. This occurs because certain methods eagerly allocate intermediate arrays before applying size limits, and the BaggagePropagator.Inject<T>() function may fail to enforce length limits when injected baggage contains only one item. This behavior can lead to a denial of service (DoS) in the consuming application when processing excessively large or malformed propagation headers. The affected functions include BaggagePropagator.Extract<T>(), BaggagePropagator.Inject<T>(), B3Propagator.Extract<T>(), and JaegerPropagator.Extract<T>().

Recommendations Update OpenTelemetry.Api to version 1.15.3. Update OpenTelemetry.Extensions.Propagators to version 1.15.3. Configure appropriate HTTP request header limits. Disable baggage or trace propagation as a temporary workaround.

Fix

DoS

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-40894

GHSA-G94R-2VXG-569J

Affected Products

Opentelemetry Api

Opentelemetry.Extensions.Propagators

References · 16

• https://github.com/open-telemetry/opentelemetry-dotnet/pull/1048 · Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7061 · Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/3309 · Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/533 · Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/3244 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40894 · Security Note
• https://osv.dev/vulnerability/GHSA-g94r-2vxg-569j · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NUGET-CVE-2026-40894 · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-dotnet · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.15.3 · Note
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/3533 · Note
• https://twitter.com/_cvereports/status/2049063775429374244 · Twitter Post
• https://twitter.com/dailycve/status/2047467221622853971 · Twitter Post
• https://twitter.com/CVEnew/status/2047428093992964550 · Twitter Post