216.73.216.128

CVE-2026-40894

· Published 23/04/2026 19:17 · Modified 24/04/2026 14:50

Labels: CVE-2026-40894 2026-04-23CVE-2026-40894CWE-789[email protected]

Essential information

Published
23/04/2026 19:17
Modified
24/04/2026 14:50
Author
—
Creator
—
CVSS
5.3 MEDIUM (v3.1)
CISA KEV
No
CWE
—
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS metrics

Description

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

NVD status

Status
Undergoing Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source
[email protected]
NVD
View on NVD

Affected products (CPE)

ProductCPE
opentelemetry / opentelemetry.api cpe:2.3:a:opentelemetry:opentelemetry.api:0.5.0-beta.2-1.15.2:*:*:*:*:*:*:*
opentelemetry / opentelemetry.extensions.propagators cpe:2.3:a:opentelemetry:opentelemetry.extensions.propagators:1.3.1-1.15.2:*:*:*:*:*:*:*

References