CVE-2025-27513 OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package
Attackers can cause denial of service via high CPU usage by sending crafted tracestate headers to applications using the OpenTelemetry .NET API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-27513?
CVE-2025-27513 is a high-severity denial of service vulnerability in open-telemetry opentelemetry-dotnet, published on 5 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.
Weakness: CWE-770
Which versions are affected by CVE-2025-27513?
4 open source packages ship an affected version, including OpenTelemetry.Api.
| Package | Affected | Fixed in |
|---|---|---|
OpenTelemetry.Api NuGet | All versions | None |
OpenTelemetry.Api NuGet | All versions | None |
OpenTelemetry.Api NuGet | From 1.11.0 | 1.11.2 |
OpenTelemetry.Api NuGet | From 1.11.0 | 1.11.2 |
How do I fix CVE-2025-27513?
Upgrade OpenTelemetry.Api to 1.11.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-27513 being exploited?
There is no known exploitation of CVE-2025-27513 in the wild and no public exploit code.
Sources
Also known as GHSA-8785-wc3w-h8q6.