CVE-2026-41078: DoS in OpenTelemetry dotnet

An attacker can exploit this vulnerability by sending a stream of telemetry data with a large number of unique tags or events (high cardinality) to the OpenTelemetry Jaeger exporter. This input triggers the exporter to allocate more memory to its internal pooled list. The enlarged size of this list is then reused for subsequent allocations, leading to a continuous increase in memory consumption. If the system lacks sufficient memory resources, this can result in a denial-of-service condition, where the application or service becomes unresponsive or crashes. The blast radius extends to any service relying on the vulnerable OpenTelemetry Jaeger exporter for telemetry collection and analysis.

1. Reserved2026-04-16
2. Published2026-04-23
3. EPSS updated2026-05-01

Given that no fix is planned for CVE-2026-41078 due to the deprecation of the Jaeger exporter, mitigation strategies should focus on reducing the cardinality of telemetry data before it reaches the exporter. This can be achieved by filtering out unnecessary tags and events, aggregating data at the source, or using sampling techniques to reduce the volume of telemetry. Consider migrating to alternative OpenTelemetry exporters that are actively maintained and offer more robust memory management. Monitor memory usage of the OpenTelemetry Jaeger exporter process and implement alerts to detect potential memory pressure. If feasible, roll back to a previous version of OpenTelemetry dotnet before the introduction of the vulnerable exporter, though this may introduce other compatibility issues.