CVE-2026-40891
Opentelemetry 1.13.1 – 1.15.3
Raw vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-40891 is a medium-severity Memory Allocation with Excessive Size Value (CWE-789) vulnerability in Opentelemetry Opentelemetry. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-16 (Memory Protection) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25268
Vulnerability Data
OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer…
more
could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixed in 1.15.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed gRPC trailer triggers excessive allocation in OTLP exporter, enabling application-layer DoS via direct exploitation of the parsing flaw.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input fields (including gRPC trailers) to reject malformed length-delimited protobuf values before they drive memory allocation.
Enforces memory-protection mechanisms that constrain or fail allocations exceeding safe bounds, blocking the excessive allocation path described in the CVE.
Limits resource availability (memory) per process or exporter, reducing the impact of any single malformed trailer that evades input checks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent coding flaws that trust unvalidated size values for allocations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect and block excessive allocation flaws before deployment.
Secure development lifecycle includes input validation and size checks that prevent unbounded allocations.
Application security requirements mandate bounds checking on size parameters to avoid excessive memory allocation.
Secure architecture principles require resource-limit enforcement that mitigates uncontrolled memory requests.
Secure coding standards directly prohibit allocating memory from untrusted size values without validation.
Capacity management monitors overall resource use but does not prevent individual allocation bugs.