OpenTelemetry dotnet CVE-2026-40894

The consuming .NET application must have OpenTelemetry distributed tracing configured and must be actively using one or more of the vulnerable propagators - BaggagePropagator (W3C Baggage header), B3Propagator (B3 single or multi-header format), or JaegerPropagator (Jaeger uber-trace-id header) - in the inbound request processing pipeline. The vulnerable code path is triggered during Extract() calls on inbound HTTP requests, meaning the application must be receiving HTTP traffic that includes these propagation headers. Applications that only emit (inject) telemetry headers outbound are partially exposed via the BaggagePropagator.Inject() single-item bypass. Exploitation is limited to applications that process propagation headers from untrusted external callers; internal service meshes where all callers are trusted and controlled are at negligible risk. HTTP servers that enforce maximum header length limits (IIS, nginx, Apache) before the request reaches application code provide an effective compensating control that eliminates the remote attack vector.

CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L indicates network-reachable, unauthenticated, low-complexity exploitation with partial availability impact - a technically plausible DoS profile. However, EPSS at 0.02% (6th percentile) and SSVC exploitation status of 'none' strongly suggest this vulnerability has not attracted attacker interest and no functional exploit is publicly known. SSVC flags it as Automatable:yes because a single crafted request can trigger the condition without human interaction, which is a valid concern for automated scanning or high-volume attack scenarios. The Technical Impact is assessed as 'partial' given the scope is limited to availability of the consuming application only. The practical risk is highest for applications that expose OpenTelemetry propagation header processing to untrusted external HTTP traffic - for example, public-facing microservices using the W3C Baggage, B3, or Jaeger propagation formats. Internal-only deployments or those behind HTTP servers with strict header size limits (such as IIS, which enforces limits by default) face substantially reduced exposure. No conflict between CVSS signals and description is detected; AV:N is appropriate because the attack arrives via HTTP request headers.

An external attacker sends HTTP requests to a public-facing .NET microservice that has OpenTelemetry distributed tracing configured with Baggage, B3, or Jaeger propagation. The requests contain crafted propagation headers consisting of large numbers of delimiter characters (e.g., commas in a baggage header), causing BaggagePropagator.Extract() or B3Propagator.Extract() to allocate memory far exceeding the header payload size before any size limit is checked. Repeated requests exhaust the application's heap, degrading or crashing the service. No public exploit code is known at time of analysis.