EUVD-2026-25269
GHSA-g94r-2vxg-569j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-delivered via HTTP headers, no auth required, no complexity beyond sending a crafted header; impact is availability only with no confidentiality or integrity effect.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
6DescriptionGitHub Advisory
OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.
AnalysisAI
Uncontrolled memory allocation in OpenTelemetry dotnet's propagation header parsing exposes .NET applications to denial of service. OpenTelemetry.Api versions 0.5.0-beta.2 through 1.15.2 and OpenTelemetry.Extensions.Propagators versions 1.3.1 through 1.15.2 contain BaggagePropagator, B3Propagator, and JaegerPropagator implementations that eagerly allocate intermediate arrays before enforcing size limits, allowing malformed headers with excessive delimiter characters to trigger disproportionate memory consumption. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.02%, and a vendor-released patch exists at version 1.15.3.
Technical ContextAI
CWE-789 (Uncontrolled Memory Allocation) describes this root cause precisely: the vulnerable code allocates memory proportional to the raw input size before applying configured length limits, meaning an attacker controls the allocation magnitude. The affected propagators - BaggagePropagator (in OpenTelemetry.Api), B3Propagator (in both OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators), and JaegerPropagator (in OpenTelemetry.Extensions.Propagators) - implement the W3C Baggage, B3, and Jaeger distributed tracing header formats respectively. Specifically, BaggagePropagator.Extract() and Inject() allocate intermediate arrays eagerly (introduced via PR #1048), B3Propagator.Extract() in both packages allocates before validation (PRs #533 and #3244), and JaegerPropagator.Extract() exhibits the same pattern (PR #3309). Additionally, BaggagePropagator.Inject() bypasses the 8192-character limit entirely when only one baggage item is present. The CPE identifiers confirm three affected components: cpe:2.3:a:open-telemetry:opentelemetry-dotnet, cpe:2.3:a:open-telemetry:opentelemetry.api, and cpe:2.3:a:open-telemetry:opentelemetry.extensions.propagators.
RemediationAI
Upgrade both OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators to version 1.15.3, which is the vendor-confirmed fixed release available at https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.15.3. For applications that cannot immediately upgrade, configure the hosting HTTP server to enforce strict request header size limits: IIS enforces a default maxRequestLength and can be tuned via the system.webServer configuration to reject oversized headers before they reach the propagation parsing layer, which eliminates the attack surface without requiring a code change. Nginx and Apache equivalents (large_client_header_buffers and LimitRequestFieldSize respectively) provide similar mitigation. Note that these server-level limits protect against the header-based vector but do not address any code paths where baggage is injected programmatically from internal sources. Consulting the GHSA advisory at https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j is recommended for full mitigating-control guidance from the maintainers.
More in Opentelemetry Dotnet
View allMemory exhaustion in the OpenTelemetry dotnet OTLP exporter (versions 1.13.1 through 1.15.1) enables a denial-of-service
Memory exhaustion via unbounded protobuf allocation in OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) affects vers
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today