CVE-2026-40894

תיאור (מקור, אנגלית)

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

מדדים

CVSS 3.1

5.3 (MEDIUM) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-29/7/2026

CWE

CWE-789

מוצרים מושפעים

opentelemetry: opentelemetry; opentelemetry: opentelemetry.api; opentelemetry: opentelemetry.extensions.propagators

קישורים

• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHS‮… MitigationVendor Advisory
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/1048 Issue TrackingPatch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/3244 Issue TrackingPatch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/3309 Issue TrackingPatch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/533 Issue TrackingPatch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7061 Issue TrackingPatch