Open-telemetry Opentelemetry-dotnet vulnerabilities

• open-telemetry opentelemetry-dotnet-contrib OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS CVE-2026-81192 Fix available 7.0 HighSeptember 8, 2026
• open-telemetry opentelemetry-dotnet-contrib OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured CVE-2026-44213 Fix available 6.5 MediumMay 8, 2026
• opentelemetry opentelemetry.opamp.client, open-telemetry opentelemetry-dotnet-contrib +1 more OpAMP client reads unbounded HTTP response bodies CVE-2026-42348 Fix available 5.9 MediumMay 5, 2026
• opentelemetry opentelemetry.exporter.opentelemetryprotocol, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter CVE-2026-42191 Fix available 6.5 MediumApril 30, 2026
• opentelemetry opentelemetry.exporter.onecollector, open-telemetry opentelemetry-dotnet-contrib +1 more OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body CVE-2026-41484 Fix available 5.3 MediumApril 29, 2026
• opentelemetry opentelemetry.resources.azure, open-telemetry opentelemetry-dotnet-contrib +1 more Unbounded HTTP response body read in OpenTelemetry.Resources.Azure CVE-2026-41483 Fix available 5.9 MediumApril 29, 2026
• opentelemetry opentelemetry.exporter.zipkin, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth CVE-2026-41310 Fix available 5.3 MediumApril 28, 2026
• open-telemetry opentelemetry-dotnet-contrib Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS CVE-2026-41173 Fix available 5.9 MediumApril 23, 2026
• open-telemetry opentelemetry.api, opentelemetry.extensions.propagators, opentelemetry +1 more +3 more OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers CVE-2026-40894 Fix available 5.3 MediumApril 23, 2026
• opentelemetry, open-telemetry opentelemetry-dotnet, opentelemetry.exporter.opentelemetryprotocol +2 more OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling CVE-2026-40891 Fix available 5.3 MediumApril 23, 2026
• opentelemetry, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies CVE-2026-40182 Fix available 5.3 MediumApril 23, 2026
• open-telemetry opentelemetry.exporter.jaeger, opentelemetry, open-telemetry opentelemetry-dotnet +2 more OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path CVE-2026-41078 5.9 MediumApril 18, 2026
• open-telemetry opentelemetry-dotnet OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package CVE-2025-27513 Fix available 7.5 HighMarch 5, 2025
• opentelemetry, open-telemetry opentelemetry-dotnet +1 more Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore CVE-2024-32028 Fix available 4.1 MediumApril 12, 2024