CVE-2025-27513

OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.

• CWE-770

• https://github.com/open-telemetry/opentelemetry-dotnet/commit/1b555c1201413f2f55f2cd3c4ba03ef4b615b6b5
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-8785-wc3w-h8q6

Published

Mar 5, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27508Emissary is a P2P based data-driven workflow engine. The Che…7.5
• CVE-2025-27509fleetdm/fleet is an open source device management, built on …9.3
• CVE-2025-2751A vulnerability has been found in Open Asset Import Library …8.8
• CVE-2025-27510conda-forge-metadata provides programatic access to conda-fo…9.3
• CVE-2025-27511GeoServer is an open source server that allows users to shar…7.2
• CVE-2025-27512Zincati is an auto-update agent for Fedora CoreOS hosts. Zin…2.1
• CVE-2025-27514GLPI is a Free Asset and IT Management Software package, Dat…5.4
• CVE-2025-27515Laravel is a web application framework. When using wildcard …9.8
• CVE-2025-27516Jinja is an extensible templating engine. Prior to 3.1.6, an…8.8
• CVE-2025-27517Volt is an elegantly crafted functional API for Livewire. Ma…9.3
• CVE-2025-27518Cognita is a RAG (Retrieval Augmented Generation) Framework …6.9
• CVE-2025-27519Cognita is a RAG (Retrieval Augmented Generation) Framework …9.3