{"id":"EUVD-2026-25268","enisaUuid":"907dbfbf-aba7-317f-864a-4565a8e34860","description":"OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.","datePublished":"Apr 23, 2026, 5:54:36 PM","dateUpdated":"Apr 23, 2026, 6:23:08 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/5980\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7064\n","aliases":"CVE-2026-40891\n","assigner":"GitHub_M","epss":0.19,"enisaIdProduct":[{"id":"2aa2eeeb-84a2-3fd5-9972-9976ebd4b32e","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"1.13.1, \u003c 1.15.3"},{"id":"a014bdba-9288-312a-9a2e-a0582a395d70","product":{"name":"OpenTelemetry.Exporter.OpenTelemetryProtocol","vendor":{"name":"open-telemetry"}},"product_version":"1.13.1, \u003c 1.15.3"}],"enisaIdVendor":[{"id":"a92f90aa-c1ef-3576-bcae-1a364298ef80","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"0c9452b9-b6b3-32bb-b5e9-1a54e43722c0","vulnerability":{"id":"CVE-2026-40891","description":"OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.","datePublished":"Apr 23, 2026, 5:54:36 PM","dateUpdated":"Apr 23, 2026, 6:23:08 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/5980\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7064\n","enisa_id":"EUVD-2026-25268\n","assigner":"GitHub_M","epss":0.19,"dataProcessed":"Oct 27, 2026, 7:16:48 AM","vulnerabilityProduct":[{"id":"2a449a6f-4ef6-32e1-a8ce-bc03a65bd052","product":{"name":"OpenTelemetry.Exporter.OpenTelemetryProtocol","vendor":{"name":"open-telemetry"}},"product_version":"1.13.1, \u003c 1.15.3"},{"id":"ce53b975-dd85-3ebc-b00e-42176cfb149b","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"1.13.1, \u003c 1.15.3"}],"vulnerabilityVendor":[{"id":"7ed469fe-b1ff-327a-992d-d6133f4499c9","vendor":{"name":"open-telemetry"}}]}},{"id":"53f1cbab-4b35-37b6-833d-491242c0854a","vulnerability":{"id":"GHSA-mr8r-92fq-pj8p","description":"OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling","datePublished":"Apr 23, 2026, 9:40:29 PM","dateUpdated":"Apr 23, 2026, 9:40:29 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40891\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/5980\nhttps://github.com/open-telemetry/opentelemetry-dotnet/pull/7064\nhttps://github.com/open-telemetry/opentelemetry-dotnet\n","enisa_id":"EUVD-2026-25268\n","aliases":"GHSA-mr8r-92fq-pj8p\nCVE-2026-40891\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}