5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41310

CVE-2026-41310: OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios, a process using Zipkin export for client or producer spans could experience avoidable memory growth under sustained unique remote endpoint values, increasing process memory usage over time and degrading availability. This issue is fixed in version 1.15.3, which introduces a bounded, thread-safe LRU cache for remote endpoints with a fixed maximum size.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41310

CVE-2026-41310:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
OpenTelemetry.Exporter.Zipkin	nuget	<= 1.15.2	1.15.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated commit c724f4bd6fd88e9a599af1668bf7af9487155b62 reveals two distinct memory consumption vulnerabilities in the OpenTelemetry Zipkin exporter for .NET. The root cause for both is the allocation of resources without proper limits.

Unbounded Endpoint Cache: The primary vulnerability, as described in the advisory, is an unbounded cache for remote service endpoints. The function OpenTelemetry.Exporter.Zipkin.Implementation.ZipkinActivityConversionExtensions.ToZipkinSpan is responsible for processing telemetry data. It extracts a peer.service attribute and uses it as a key for a cache. The original implementation used a standard ConcurrentDictionary, which has no built-in size limit. An attacker or a high-cardinality workload could supply a stream of spans with unique peer.service values, causing the cache to grow indefinitely and leading to excessive memory usage and potential process termination. The patch replaces the ConcurrentDictionary with a custom, bounded LRU cache (ZipkinEndpointLruCache) to cap its size.
Unbounded MemoryStream Capacity: A secondary issue was fixed in the same patch within the OpenTelemetry.Exporter.Zipkin.Implementation.JsonStringArrayTagWriter.JsonArrayTagWriter.Write function. This function uses a ThreadStatic MemoryStream for performance when serializing array tags. If a very large array was serialized, the underlying MemoryStream would allocate a large buffer. This buffer's capacity was never reduced, so the memory remained allocated for the thread's lifetime, even if subsequent uses were small. The patch hardens this by checking the stream's capacity after use and resetting it if it exceeds a defined maximum, thus releasing the excess memory.

Both functions are directly involved in processing potentially untrusted or high-cardinality telemetry data, and the modifications in the patch directly address the uncontrolled resource allocation that leads to the vulnerability.

Vulnerable functions

OpenTelemetry.Exporter.Zipkin.Implementation.ZipkinActivityConversionExtensions.ToZipkinSpan

src/OpenTelemetry.Exporter.Zipkin/Implementation/ZipkinActivityConversionExtensions.cs

This function converts an `Activity` to a `ZipkinSpan`. As part of this conversion, it extracts the `peer.service` attribute and uses it to look up or create a `ZipkinEndpoint`. The vulnerability lies in the caching mechanism for these endpoints. Prior to the patch, an unbounded `ConcurrentDictionary` was used for the cache. When processing spans with high-cardinality `peer.service` values, this cache would grow indefinitely, leading to uncontrolled memory consumption and potential denial of service.

OpenTelemetry.Exporter.Zipkin.Implementation.JsonStringArrayTagWriter.JsonArrayTagWriter.Write

src/Shared/TagWriter/JsonStringArrayTagWriter.cs

This function writes array tags to a JSON string using a reusable, thread-local `MemoryStream`. The vulnerability is that if a very large array tag is processed, the `MemoryStream`'s capacity would increase significantly and would not be reclaimed for the lifetime of the thread. This could lead to sustained high memory usage in threads that have processed large tags, causing memory pressure. The patch mitigates this by resetting the stream's capacity after use if it has grown too large.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.