CVE-2026-40182

{
  "id": "CVE-2026-40182",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-23T18:16:28.130",
  "lastModified": "2026-10-26T22:10:00.163",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2."
    },
    {
      "lang": "es",
      "value": "OpenTelemetry dotnet es un framework de telemetría de dotnet. Desde la versión 1.13.1 hasta antes de la 1.15.2, al exportar telemetría a un back-end/colector a través de gRPC o HTTP utilizando el formato del protocolo OpenTelemetry (OTLP), si la solicitud resulta en una solicitud fallida (es decir, HTTP 4xx o 5xx), la respuesta se lee en la memoria sin un límite superior en el número de bytes consumidos. Esto podría causar agotamiento de la memoria en la aplicación consumidora si el punto final del back-end/colector configurado está controlado por un atacante (o un atacante de red puede realizar un MitM en la conexión) y la respuesta devuelve un cuerpo extremadamente grande. Esta vulnerabilidad está corregida en la versión 1.15.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "open-telemetry",
          "product": "opentelemetry-dotnet",
          "versions": [
            {
              "version": ">= 1.13.1, < 1.15.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-23T18:38:48.491134Z",
          "id": "CVE-2026-40182",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*",
              "versionStartIncluding": "1.13.1",
              "versionEndExcluding": "1.15.2",
              "matchCriteriaId": "5539A01E-6E54-4AE2-8D72-6E5C15C01C61"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/pull/6564",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/pull/7017",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-q834-8qmm-v933",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/open-telemetry/opentelemetry-proto/pull/781",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking"
      ]
    }
  ]
}