OpenTelemetry .NET hat potenziellen Speichererschöpfung durch unbegrenzte Pool-Listen-Größen im Jaeger-Exporteur-Konvertierungspfad

The primary impact of CVE-2026-41078 is a denial-of-service condition. An attacker capable of influencing the telemetry data sent to the OpenTelemetry Jaeger exporter can craft payloads that cause the internal pooled-list sizing to grow excessively. This enlarged size is then reused for subsequent memory allocations, leading to a sustained memory pressure. The severity stems from the potential for complete application failure, especially in resource-constrained environments. While the Jaeger exporter is deprecated, it may still be in use within existing deployments, making this a potential risk for organizations transitioning away from it. The blast radius is limited to applications using the vulnerable exporter and their underlying infrastructure.

Organizations using OpenTelemetry dotnet versions 1.0.0 through 1.6.0-rc.1 for telemetry collection and analysis, particularly those relying on the deprecated Jaeger exporter, are at risk. Systems with limited memory resources are especially vulnerable to DoS attacks.

• dotnet / memory: Use dotnet-counters to monitor memory usage of the OpenTelemetry Jaeger exporter process. Look for sustained increases in memory allocation.

dotnet-counters -m OpenTelemetry.Exporter.Jaeger

• dotnet / telemetry: Analyze telemetry data for unusually high cardinality (number of unique tags/events). Implement logging and monitoring to track the size and composition of telemetry payloads. • generic / system: Monitor system memory usage. High memory utilization by the OpenTelemetry process could indicate exploitation.

top -c

1. 2026-04-23Disclosure

   disclosure

1. Reserviert2026-04-16
2. Veröffentlicht2026-04-23
3. EPSS aktualisiert2026-05-01

Given that a fix is not planned for CVE-2026-41078, the primary mitigation strategy is to avoid using the deprecated OpenTelemetry.Exporter.Jaeger component entirely. Organizations should migrate to supported OpenTelemetry exporters as soon as possible. If immediate migration is not feasible, consider limiting the cardinality of telemetry data sent to the Jaeger exporter through filtering or aggregation techniques. While not a direct mitigation, monitoring memory usage of the application and setting appropriate resource limits (e.g., container memory limits) can help prevent complete outages. After migrating away from the Jaeger exporter, confirm by verifying that the application no longer utilizes the component and that telemetry data is being sent to a supported exporter.