What’s Vulnerable › Vulnerabilities

CVE-2026-41310: OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-06 · updated 2026-10-26
• Weakness: CWE-400

Description

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios, a process using Zipkin export for client or producer spans could experience avoidable memory growth under sustained unique remote endpoint values, increasing process memory usage over time and degrading availability. This issue is fixed in version 1.15.3, which introduces a bounded, thread-safe LRU cache for remote endpoints with a fixed maximum size.

Affected products

• @opentelemetry Opentelemetry.Exporter.Zipkin: before 1.15.3 — fixed in 1.15.3

How to fix

Upgrade to a fixed version: @opentelemetry Opentelemetry.Exporter.Zipkin 1.15.3. Check the vendor advisory for mitigations.

References

• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7081
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-88hf-wf7h-7w4m

Get alerted when CVE-2026-41310 or the next vulnerability affects your stack