5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40891

CVE-2026-40891: OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40891

CVE-2026-40891:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
OpenTelemetry.Exporter.OpenTelemetryProtocol	nuget	>= 1.13.1, < 1.15.3	1.15.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the GrpcStatusDeserializer class of the OpenTelemetry.Exporter.OpenTelemetryProtocol library, which is used to parse gRPC status details during retry operations. The core issue is the failure to validate length fields read from the grpc-status-details-bin trailer before using them for memory allocation or stream manipulation. An attacker-controlled OTLP endpoint can return a retryable status (ResourceExhausted or Unavailable) along with a crafted trailer containing a protobuf message with an excessively large length value for a length-delimited field.

The primary vulnerable function is OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation.ExportClient.Grpc.GrpcStatusDeserializer.DecodeBytes. This function would read the malicious length and attempt to allocate a byte array of that size, directly causing a large memory allocation that could exhaust available memory and crash the process, resulting in a Denial of Service. The fixing commits confirm this by adding strict bounds checking on the decoded length against int.MaxValue and the remaining bytes in the stream.

Further analysis of the patch shows that other functions within the same class (DecodeDuration, DecodeAny, SkipField) that also process length-delimited fields were similarly missing these crucial validation checks. While DecodeBytes presents the most direct path to DoS via memory allocation, these other functions were also patched to prevent potential errors or exceptions from malformed lengths, indicating they were also considered part of the overall security hardening. Therefore, they are included as functions that would be involved in processing the malicious payload.

Vulnerable functions

OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation.ExportClient.Grpc.GrpcStatusDeserializer.DecodeBytes

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/ExportClient/Grpc/GrpcStatusDeserializer.cs

This function is responsible for decoding a byte array from a protobuf stream. The vulnerability lies in the fact that it reads a length value from the stream and uses it to allocate a new byte array (`new byte[length]`) without first validating the size of the length. A malicious server could provide an extremely large length value, causing the application to attempt a huge memory allocation, leading to an OutOfMemoryException and a Denial of Service.

OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation.ExportClient.Grpc.GrpcStatusDeserializer.DecodeDuration

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/ExportClient/Grpc/GrpcStatusDeserializer.cs

This function decodes a 'Duration' message from the stream. Similar to DecodeBytes, it reads a length from the stream. Although it doesn't directly allocate a large buffer based on this length, an invalid length could cause it to read past the intended message boundaries, leading to exceptions or incorrect parsing. The patch adds the `CheckLength` call to validate the length before proceeding.

OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation.ExportClient.Grpc.GrpcStatusDeserializer.DecodeAny

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/ExportClient/Grpc/GrpcStatusDeserializer.cs

This function decodes an 'Any' message from the stream. It was vulnerable for the same reason as DecodeDuration, where an unvalidated length could lead to incorrect stream parsing. The patch mitigates this by adding the `CheckLength` validation.

OpenTelemetry.Exporter.OpenTelemetryProtocol.Implementation.ExportClient.Grpc.GrpcStatusDeserializer.SkipField

src/OpenTelemetry.Exporter.OpenTelemetryProtocol/Implementation/ExportClient/Grpc/GrpcStatusDeserializer.cs

This function is used to skip over fields in the protobuf stream. For length-delimited fields, it reads a length and advances the stream's position. Without validation, a malicious length could cause the stream position to be set to an invalid location (e.g., past the end of the stream), causing an exception. The patch adds the `CheckLength` call to ensure the length is valid before seeking.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.