{"id":"CVE-2026-41078","revision":"b85b754ef7054933918b0a569420b93c","records":[{"revision":"b85b754ef7054933918b0a569420b93c","observedAt":"2026-10-25T09:17:30.114+00:00","statement":{"source":"nvd","id":"CVE-2026-41078","aliases":[],"title":"OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that en…","description":"OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.","state":0,"publishedAt":"2026-04-23T19:17:28.95+00:00","modifiedAt":"2026-06-17T10:46:08.023+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":"MEDIUM"}],"references":["https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41078","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*","cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:alpha1:*:*:*:.net:*:*","cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta1:*:*:*:.net:*:*","cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta2:*:*:*:.net:*:*","cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta3:*:*:*:.net:*:*","cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:rc1:*:*:*:.net:*:*"],"sourceDates":{"published":"2026-04-23T19:17:28.950","lastModified":"2026-06-17T10:46:08.023"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41078","identifiers":["CVE-2026-41078"]},"retained":false,"historicalAffected":[]}],"coverage":[]}