5.9

CVE-2026-41078

OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opentelemetry ≫ Opentelemetry SwPlatform.net Version < 1.6.0
Opentelemetry ≫ Opentelemetry Version1.6.0 Updatealpha1 SwPlatform.net
Opentelemetry ≫ Opentelemetry Version1.6.0 Updatebeta1 SwPlatform.net
Opentelemetry ≫ Opentelemetry Version1.6.0 Updatebeta2 SwPlatform.net
Opentelemetry ≫ Opentelemetry Version1.6.0 Updatebeta3 SwPlatform.net
Opentelemetry ≫ Opentelemetry Version1.6.0 Updaterc1 SwPlatform.net
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.126
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47
Vendor Advisory