{"id":"EUVD-2026-25270","enisaUuid":"8ca9e5f6-eceb-3869-a457-24cf95242140","description":"OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.","datePublished":"Apr 23, 2026, 6:05:41 PM","dateUpdated":"Apr 23, 2026, 6:52:26 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47\n","aliases":"CVE-2026-41078\nGHSA-38h3-2333-qx47\n","assigner":"GitHub_M","epss":0.22,"enisaIdProduct":[{"id":"19db85c0-b87a-3931-aaa7-325e44ce12d0","product":{"name":"OpenTelemetry.Exporter.Jaeger","vendor":{"name":"open-telemetry"}},"product_version":"≤ 1.6.0-rc.1"},{"id":"bafe011c-71c6-362d-a39a-5fb7bb04411a","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"≤ 1.6.0-rc.1"}],"enisaIdVendor":[{"id":"166e599b-00cf-3f2b-82b1-c11335da78ec","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"37f9e7e8-44cb-3467-b101-6482ae26797f","vulnerability":{"id":"CVE-2026-41078","description":"OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.","datePublished":"Apr 23, 2026, 6:05:41 PM","dateUpdated":"Apr 23, 2026, 6:52:26 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47\n","enisa_id":"EUVD-2026-25270\n","assigner":"GitHub_M","epss":0.22,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"3676f046-f03b-32e6-b9dd-45150248e457","product":{"name":"opentelemetry-dotnet","vendor":{"name":"open-telemetry"}},"product_version":"≤ 1.6.0-rc.1"},{"id":"4182528e-1c32-36ea-b98c-71fc68f0bd0f","product":{"name":"OpenTelemetry.Exporter.Jaeger","vendor":{"name":"open-telemetry"}},"product_version":"≤ 1.6.0-rc.1"}],"vulnerabilityVendor":[{"id":"f23be008-fb69-3c0c-b804-917782d01100","vendor":{"name":"open-telemetry"}}]}},{"id":"fc2cceee-dda3-3473-a549-8fbb11b4310b","vulnerability":{"id":"GHSA-38h3-2333-qx47","description":"OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path","datePublished":"Apr 18, 2026, 1:05:12 AM","dateUpdated":"Apr 27, 2026, 4:15:48 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41078\nhttps://github.com/open-telemetry/opentelemetry-dotnet\n","enisa_id":"EUVD-2026-25270\n","aliases":"GHSA-38h3-2333-qx47\nCVE-2026-41078\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}