{"action":"Upgrade OpenTelemetry.Exporter.OpenTelemetryProtocol to 1.15.3 or later.","affected":[{"fixed":"1.15.3","introduced":"1.13.1"}],"component":"OpenTelemetry.Exporter.OpenTelemetryProtocol","cve_ids":["CVE-2026-40891"],"ecosystem":"NuGet","epss":0.00192,"exploited":false,"fixed_versions":["1.15.3"],"ghsa_id":"GHSA-mr8r-92fq-pj8p","id":"tcs_01M5N8V2P68E9WW939APG98SBA","modified_at":"2026-09-10T03:50:44.892821031Z","published_at":"2026-04-23T21:40:29Z","references":["https://osv.dev/vulnerability/GHSA-mr8r-92fq-pj8p","https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p","https://nvd.nist.gov/vuln/detail/CVE-2026-40891","https://github.com/open-telemetry/opentelemetry-dotnet/pull/5980","https://github.com/open-telemetry/opentelemetry-dotnet/pull/7064","https://github.com/open-telemetry/opentelemetry-dotnet"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-mr8r-92fq-pj8p","url":"https://osv.dev/vulnerability/GHSA-mr8r-92fq-pj8p"}],"summary":"OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling"}