CVE-2026-40894Disclosure(opentelemetry / opentelemetry)

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

opentelemetry CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Vendor / third-party advisories

https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j

Weakness type (CWE)

CWE-789

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

opentelemetry
opentelemetry.api
opentelemetry.extensions.propagators

Threat summary

3 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 1 mentions (2026-04-23); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

opentelemetry

Products

opentelemetryopentelemetry.apiopentelemetry.extensions.propagators

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

General

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-23	1	General1
2026-04-24	1	Disclosure1
2026-04-28	1	Disclosure1

Full discourse3 posts

cvereports@_cvereports163d
Disclosure
CVE-2026-40894: CVE-2026-40894: Excessive Memory Allocation in OpenTelemetry .NET Propagation Headers The OpenTelemetry .NET SDK contains a denial of service vulnerability due to excessive memory allocation during the parsing of propagation headers. V... https://cvereports.com/reports/CVE-2026-40894
Post summary
The post announces a denial-of-service vulnerability in the OpenTelemetry .NET SDK caused by excessive memory allocation while parsing propagation headers, but it provides no proof‑of‑concept, exploit code, or patch details.
0000026
36 followersView on X
DailyCVE@dailycve168d
Disclosure
🟠 OpenTelemetry NET, Memory Allocation DoS, #CVE-2026-40894 (Medium) https://dailycve.com/opentelemetry-net-memory-allocation-dos-cve-2026-40894-medium/
Post summary
A Medium‑severity memory allocation denial‑of‑service vulnerability (CVE‑2026‑40894) in OpenTelemetry.NET has been disclosed, with only basic technical details provided.
0000036
183 followersView on X
CVE@CVEnew168d
General
CVE-2026-40894 OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implem… https://www.cve.org/CVERecord?id=CVE-2026-40894
Post summary
The post announces CVE-2026-40894, outlining affected OpenTelemetry .NET packages and version ranges. No PoC, exploit, active exploitation, patch, or false‑positive claim is mentioned.
00000105
57.2K followersView on X

CPE platform detail3 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

3 of 3 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	opentelemetry	opentelemetry	-	.net	-
App	opentelemetry	opentelemetry.api	-	.net	-
App	opentelemetry	opentelemetry.extensions.propagators	-	-	-

Explore more

Back to dashboard opentelemetry CVEs opentelemetry vulnerabilities