OpenTelemetry dotnet CVE-2026-40182

Exploitation requires both of the following specific conditions: (1) the attacker must either control the OTLP collector/backend endpoint defined in the application's telemetry configuration, or be capable of performing a man-in-the-middle attack on the network path between the application and its collector; and (2) the application must use OpenTelemetry.Exporter.OpenTelemetryProtocol at a version between 1.13.1 and 1.15.1 inclusive with OTLP export actively configured over HTTP or gRPC. The adjacent-network attack vector (AV:A) limits exploitation to attackers with physical or logical adjacency to the export network path - remote internet-based attackers without network adjacency cannot exploit this directly. Applications exporting telemetry exclusively to internal, authenticated collectors over private networks are not realistically at risk. The SSVC Automatable:no rating confirms the attack cannot be trivially replicated at scale.

The provided CVSS 5.3 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the constrained threat model: the attacker must occupy a network-adjacent position and either control the OTLP collector endpoint or execute a man-in-the-middle attack, both of which constitute high complexity prerequisites. EPSS at 0.01% (3rd percentile) and SSVC Exploitation:none independently confirm no observed exploitation activity, making this a low-urgency finding despite the High availability impact rating. SSVC Automatable:no aligns with AC:H - the attack cannot be scripted for mass exploitation. Technical Impact:partial reflects that only the exporting application's availability is affected, with no confidentiality or integrity consequence. Real-world risk is concentrated in deployments where the OTLP export path traverses untrusted network segments or uses third-party collector endpoints; applications exporting to internal, trusted collectors over authenticated channels face negligible realistic risk. The 'Information Disclosure' tag present in the input data appears to be a metadata error - the GHSA advisory, CWE-789, and CVSS vector all confirm the sole impact is availability (DoS), not information disclosure.

An attacker positioned on the same network segment as a .NET application (e.g., via ARP spoofing on a shared LAN or cloud VPC) intercepts the OTLP telemetry export connection and responds to export requests with HTTP 503 responses containing a multi-gigabyte response body. The application's OTLP exporter reads the entire body into memory without bound, exhausting the process heap and crashing the application. No public exploit code has been identified for this vulnerability.