CVE-2026-40891

{
  "id": "CVE-2026-40891",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-23T18:16:28.483",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2."
    },
    {
      "lang": "es",
      "value": "OpenTelemetry dotnet es un framework de telemetría dotnet. Desde 1.13.1 hasta antes de 1.15.2, al exportar telemetría a través de gRPC utilizando el Protocolo OpenTelemetry (OTLP), el exportador puede analizar un tráiler grpc-status-details-bin proporcionado por el servidor durante el manejo de reintentos. Antes de la corrección, un tráiler malformado podría codificar un campo protobuf delimitado por longitud extremadamente grande que se utilizaba directamente para la asignación, permitiendo una asignación de memoria excesiva y una potencial denegación de servicio (DoS). Esta vulnerabilidad está corregida en 1.15.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "open-telemetry",
          "product": "opentelemetry-dotnet",
          "versions": [
            {
              "version": ">= 1.13.1, < 1.15.3",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "open-telemetry",
          "product": "OpenTelemetry.Exporter.OpenTelemetryProtocol",
          "versions": [
            {
              "version": ">= 1.13.1, < 1.15.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-23T18:22:43.489569Z",
          "id": "CVE-2026-40891",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*",
              "versionStartIncluding": "1.13.1",
              "versionEndExcluding": "1.15.3",
              "matchCriteriaId": "9BACBB49-0AF7-4FB3-AAFB-1C9AB3E43F60"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064",
      "source": "[email protected]",
      "tags": [
        "Issue Tracking",
        "Patch"
      ]
    },
    {
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}