NuGet/OpenTelemetry.Extensions.Propagators CVE-2026-40894: medium 5.3, EPSS 0.46%
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
Action: Upgrade OpenTelemetry.Extensions.Propagators to 1.15.3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.3.1 | 1.15.3 | - |
Fixed versions
| 1.15.3 |
Sources
- osv: GHSA-g94r-2vxg-569j#NuGet/OpenTelemetry.Extensions.Propagators
- https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j
- https://nvd.nist.gov/vuln/detail/CVE-2026-40894
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/1048
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/3244
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/3309
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/3533
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/533
- https://github.com/open-telemetry/opentelemetry-dotnet/pull/7061
- https://github.com/open-telemetry/opentelemetry-dotnet
- https://github.com/open-telemetry/opentelemetry-dotnet/releases/tag/core-1.15.3
CVE-2026-40894 · published · modified · JSON