CVE-2026-40891: Opentelemetry

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

Affected products

• Opentelemetry Opentelemetry: from 1.13.1, before 1.15.3 (fixed in 1.15.3)

Published 2026-04-23. Last modified 2026-06-17.