Cyber Resilience

CVE-2026-40891

Opentelemetry 1.13.1 – 1.15.3

Published
23 April 2026
Modified
29 April 2026
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0019 9th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-40891 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Opentelemetry Opentelemetry. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer…

more

could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

Malformed gRPC trailer triggers excessive allocation in OTLP exporter, enabling application-layer DoS via direct exploitation of the parsing flaw.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-44967Same product: Opentelemetry Opentelemetry
CVE-2026-40182Same product: Opentelemetry Opentelemetry
CVE-2026-41178Same product: Opentelemetry Opentelemetry
CVE-2026-39882Same product: Opentelemetry Opentelemetry
CVE-2026-41078Same product: Opentelemetry Opentelemetry
CVE-2026-40894Same product: Opentelemetry Opentelemetry
CVE-2026-29181Same product: Opentelemetry Opentelemetry
CVE-2026-39883Same product: Opentelemetry Opentelemetry
CVE-2023-45142Same product: Opentelemetry Opentelemetry
CVE-2023-47108Same product: Opentelemetry Opentelemetry

Affected Assets

opentelemetry
opentelemetry
1.13.1 — 1.15.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-16 Memory Protection
  • SC-6 Resource Availability
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of all input fields (including gRPC trailers) to reject malformed length-delimited protobuf values before they drive memory allocation.

prevent

Enforces memory-protection mechanisms that constrain or fail allocations exceeding safe bounds, blocking the excessive allocation path described in the CVE.

prevent

Limits resource availability (memory) per process or exporter, reducing the impact of any single malformed trailer that evades input checks.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development can detect and block excessive allocation flaws before deployment.

prevents

Secure development lifecycle includes input validation and size checks that prevent unbounded allocations.

prevents

Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.

prevents

Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.

prevents

Secure coding standards directly prohibit allocating memory from untrusted size values without validation.

none

Capacity management monitors overall resource use but does not prevent individual allocation bugs.

References