{"id":"EUVD-2026-25266","enisaUuid":"5abb7113-59af-32ce-900a-af326a8199fa","description":"OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2.","datePublished":"Apr 23, 2026, 5:51:34 PM","dateUpdated":"Apr 23, 2026, 6:38:57 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-q834-8qmm-v933\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/6564\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7017\nhttps://github.com/open-telemetry/opentelemetry-proto/pull/781\n","aliases":"CVE-2026-40182\n","assigner":"GitHub_M","epss":0.3,"enisaIdProduct":[{"id":"d7f37bf4-aec0-392d-b0bb-bf64b83f02ab","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"1.13.1, \u003c 1.15.2"}],"enisaIdVendor":[{"id":"d2b9bb15-197d-3790-b368-b5196b65bd52","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"4bc0baf3-c6d0-3aed-aea7-04c75a24323d","vulnerability":{"id":"GHSA-q834-8qmm-v933","description":"OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies","datePublished":"Apr 23, 2026, 9:26:10 PM","dateUpdated":"Apr 23, 2026, 9:26:10 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-q834-8qmm-v933\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40182\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/6564\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7017\nhttps://github.com/open-telemetry/opentelemetry-proto/pull/781\nhttps://github.com/open-telemetry/opentelemetry-dotnet\n","enisa_id":"EUVD-2026-25266\n","aliases":"CVE-2026-40182\nGHSA-q834-8qmm-v933\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6d45ef32-b752-3a18-9b22-7421f808b0d3","vulnerability":{"id":"CVE-2026-40182","description":"OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2.","datePublished":"Apr 23, 2026, 5:51:34 PM","dateUpdated":"Apr 23, 2026, 6:38:57 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-q834-8qmm-v933\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/6564\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7017\nhttps://github.com/open-telemetry/opentelemetry-proto/pull/781\n","enisa_id":"EUVD-2026-25266\n","assigner":"GitHub_M","epss":0.3,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"0083b3b6-ac80-324c-938f-2dfb0944d69e","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"1.13.1, \u003c 1.15.2"}],"vulnerabilityVendor":[{"id":"90448276-8ff3-3299-baa9-fa65731e47a1","vendor":{"name":"open-telemetry"}}]}}],"enisaIdAdvisory":[]}