Description
OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.
Affected products
opentelemetry: opentelemetry; opentelemetry: opentelemetry.api; opentelemetry: opentelemetry.extensions.propagators
References6
- github.com/open-telemetry/opentelemetry-dotnet/security/advisor… MitigationVendor Advisory
- github.com/open-telemetry/opentelemetry-dotnet/pull/1048 Issue TrackingPatch
- github.com/open-telemetry/opentelemetry-dotnet/pull/3244 Issue TrackingPatch
- github.com/open-telemetry/opentelemetry-dotnet/pull/3309 Issue TrackingPatch
- github.com/open-telemetry/opentelemetry-dotnet/pull/533 Issue TrackingPatch
- github.com/open-telemetry/opentelemetry-dotnet/pull/7061 Issue TrackingPatch
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - EPSS — exploit probability
- 0% percentile: 40 · as of 13 November 2026
- CWE
- CWE-789
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.