CVE-2026-40182

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2.

• CWE-789

• https://github.com/open-telemetry/opentelemetry-dotnet/pull/6564Issue Tracking, Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/pull/7017Issue Tracking, Patch
• https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-q834-8qmm-v933Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-proto/pull/781Issue Tracking

Published

Apr 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40177ajenti.plugin.core defines all necessary core elements to al…7.5
• CVE-2026-40178ajenti.plugin.core defines all necessary core elements to al…5.9
• CVE-2026-40179Prometheus is an open-source monitoring system and time seri…6.1
• CVE-2026-4018TOCTOU Race Condition in specific trace commands of the Trac…6.4
• CVE-2026-40180Quarkus OpenAPI Generator is Quarkus' extensions for generat…7.5
• CVE-2026-40181React Router is a router for React. In versions 7.0.0 throug…6.1
• CVE-2026-40183ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-40184TREK is a collaborative travel planner. Prior to 2.7.2, TREK…5.3
• CVE-2026-40185TREK is a collaborative travel planner. Prior to 2.7.2, TREK…6.5
• CVE-2026-40186ApostropheCMS is an open-source Node.js content management s…6.1
• CVE-2026-40187In egroupware version 26.0 and earlier, an authenticated adm…8.6
• CVE-2026-40188goshs is a SimpleHTTPServer written in Go. From 1.0.7 to bef…7.7