5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40894

CVE-2026-40894: OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40894

CVE-2026-40894:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
OpenTelemetry.Api	nuget	>= 0.5.0-beta.2, < 1.15.3	1.15.3
OpenTelemetry.Extensions.Propagators	nuget	>= 1.3.1, < 1.15.3	1.15.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the parsing of OpenTelemetry propagation headers (baggage, b3, uber-trace-id). Several propagator implementations used string.Split() to parse header values based on delimiters like commas, hyphens, or colons. This approach is inefficient and dangerous when handling untrusted input, as a malicious actor can craft a header with a very large number of delimiters. The string.Split() method would then attempt to allocate an array to hold all the resulting substrings, leading to excessive memory allocation and a potential Denial of Service (DoS) in the application.

The patch addresses this by replacing the calls to string.Split() with manual, iterative parsing loops that process the header string segment by segment. This approach uses ReadOnlySpan<char> for efficient slicing and avoids allocating a large intermediate array, thus mitigating the memory exhaustion risk. Additionally, a related issue in BaggagePropagator.Inject was fixed, where the maximum header length was not always correctly enforced, which could lead to generating non-compliant and overly long headers.

Vulnerable functions

OpenTelemetry.Context.Propagation.BaggagePropagator.Extract

src/OpenTelemetry.Api/Context/Propagation/BaggagePropagator.cs

The `Extract` method, via its internal helper `TryExtractBaggage`, previously used `string.Split(',')` to parse the baggage header. A malformed header containing a large number of comma delimiters would cause `Split` to allocate an excessively large array of strings, leading to high memory consumption and a potential denial-of-service (DoS). The patch replaces this with an iterative, span-based parsing approach (`ReadNextSegment`) that processes the header one segment at a time, avoiding the large allocation.

OpenTelemetry.Context.Propagation.BaggagePropagator.Inject

src/OpenTelemetry.Api/Context/Propagation/BaggagePropagator.cs

The `Inject` method was vulnerable because it did not correctly enforce the `MaxBaggageLength` (8192 characters) limit when constructing the baggage header. The previous implementation could append a new item that caused the total length to exceed the limit. The patch fixes this by pre-calculating the length of the next item and checking it against the remaining available space before appending it to the header string.

OpenTelemetry.Context.Propagation.B3Propagator.Extract

src/OpenTelemetry.Api/Context/Propagation/B3Propagator.cs

When using the B3 single-header format, the `Extract` method (via `ExtractFromSingleHeader`) used `header.Split('-')` to parse the context. An attacker could provide a header with a very large number of hyphen delimiters, causing `Split` to allocate a large array and leading to excessive memory consumption and a potential denial-of-service. The patch refactors this to use a manual, iterative parsing method (`ReadNextPart`) that avoids the large allocation.

OpenTelemetry.Extensions.Propagators.B3Propagator.Extract

src/OpenTelemetry.Extensions.Propagators/B3Propagator.cs

This function has the same vulnerability as its counterpart in the `OpenTelemetry.Api` package. When parsing a B3 single-header, it used `header.Split('-')`, which eagerly allocates an array for all substrings. A malicious header with a large number of delimiters would cause excessive memory allocation, leading to a potential DoS. The patch replaces this with an iterative parsing method (`ReadNextPart`) to mitigate the issue.

OpenTelemetry.Extensions.Propagators.JaegerPropagator.Extract

src/OpenTelemetry.Extensions.Propagators/JaegerPropagator.cs

The `Extract` method, through its helper `TryExtractTraceContext`, used `jaegerHeader.Split(':')` to parse the Jaeger trace context header. A malformed header with a large number of colon delimiters would cause the `Split` method to allocate an excessively large array, leading to high memory usage and a potential denial-of-service. The patch introduces an iterative parsing method (`ReadNextComponent`) that processes the header without the large upfront allocation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.