https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T22:45:39.094349+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-292827 EUVD-2026-292827 2026-10-12T22:45:39.152672+00:00 EUVD-2026-292827 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40894 fkie_cve-2026-40894 2026-10-12T22:45:39.152772+00:00

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

 https://cve.radiocsirt.org/vuln/ghsa-g94r-2vxg-569j GHSA-g94r-2vxg-569j — OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers 2026-10-12T22:45:39.152857+00:00

Affected: NuGet: OpenTelemetry.Api, NuGet: OpenTelemetry.Extensions.Propagators

### Summary

The implementation details of the baggage, B3 and Jaeger processing code in the `OpenTelemetry.Api` and `OpenTelemetry.Extensions.Propagators` NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application.

### Details

#### Exceeding Limits

[`BaggagePropagator.Inject<T>()`](https://github.com/open-telemetry/opentelemetry-dotnet/blob/fc1a2864d1665bda857089e11fe9247e3c75637a/src/OpenTelemetry.Api/Context/Propagation/BaggagePropagator.cs#L93-L112) does not enforce the length limit of `8192` characters if the injected baggage contains only one item.

This change was introduced by #1048.

#### Excessive allocation

The following methods eagerly allocate intermediate arrays before applying size limits.

- [`BaggagePropagator.Extract<T>()`](https://github.com/open-telemetry/opentelemetry-dotnet/blob/888d1bf2489fb7408d3c5e8758a5bbffa89a8fb2/src/OpenTelemetry.Api/Context/Propagation/BaggagePropagator.cs#L52-L55) - this change was introduced by #1048. - [`BaggagePropagator.Inject<T>()`](https://github.com/open-telemetry/opentelemetry-dotnet/blob/888d1bf2489fb7408d3c5e8758a5bbffa89a8fb2/src/OpenTelemetry.Api/Context/Propagation/BaggagePropagator.cs#L138-L157) - this change was introduced by #1048. - [`B3Propagator.Extract<T>()`](https://github.com/open-telemetry/opentelemetry-dotnet/blob/888d1bf2489fb7408d3c5e8758a5bbffa89a8fb2/src/OpenTelemetry.Extensions.Propagators/B3Propagator.cs#L203-L20…