What’s Vulnerable › Vulnerabilities
CVE-2026-41078: OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-23 · updated 2026-10-26
- Weakness: CWE-770
Description
OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.
Affected products
- open-telemetry opentelemetry-go: before 1.6.0; 1.6.0-alpha1, 1.6.0-beta1, 1.6.0-beta2, 1.6.0-beta3, 1.6.0-rc1 — fixed in 1.6.0
How to fix
Upgrade to a fixed version: open-telemetry opentelemetry-go 1.6.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-41078 or the next vulnerability affects your stack