OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980 Issue Tracking, Patch
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064 Issue Tracking, Patch
- https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · opentelemetryNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*
References 3
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980 Issue Tracking, Patch
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064 Issue Tracking, Patch
- https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p Mitigation, Vendor Advisory