OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-40891 · Microsoft / collected KEV context

EUVD-2026-25268

GHSA-mr8r-92fq-pj8p

cve-program · CVE-2026-40891

• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064

euvd · EUVD-2026-25268

• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064

nvd · CVE-2026-40891

• https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p

osv · GHSA-mr8r-92fq-pj8p

• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p
• https://nvd.nist.gov/vuln/detail/CVE-2026-40891
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064
• https://github.com/open-telemetry/opentelemetry-dotnet

No related operational record is retained in the current change model.