CVE-2026-40894: open-telemetry opentelemetry-dotnet
Vulnerability summary
CVE-2026-40894 is a medium (CVSS 5.3) vulnerability in open-telemetry opentelemetry-dotnet. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 23-04-2026PublishedVulnerability first disclosed.
- 23-04-2026Last modifiedVulnerability information updated.
Description
OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · WolfiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · NugetEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.57%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
+0.11 pp
From 0.46% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard3 products
- azure-functions-host< 4.1051.100-r0
- kubernetes-reflector< 10.0.39-r1
- promitor< 2.15.0-r3
Open-telemetry3 products
- opentelemetry-dotnet≥ 0.5.0-beta.2, < 1.15.3
- opentelemetry.api≥ 0.5.0-beta.2, < 1.15.3
- opentelemetry.extensions.propagators≥ 1.3.1, < 1.15.3
Opentelemetry3 products
- opentelemetry≥ 0.5.0, < 1.15.3
- opentelemetry.api≥ 0.5.0, < 1.15.3
- opentelemetry.extensions.propagators> 1.3.0, < 1.15.3
NuGet2 products
- OpenTelemetry.Api≥ 0.5.0-beta.2, < 1.15.3
- OpenTelemetry.Extensions.Propagators≥ 1.3.1, < 1.15.3
Wolfi2 products
- kubernetes-reflector< 10.0.39-r1
- promitor< 2.15.0-r3
5 vendors · 13 products
References
11 links- github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569jX Refsource CONFIRMAdvisoryWEBMitigationVendor Advisory
