CVE-2026-41078 OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path
Attacker can cause denial of service via memory exhaustion in the deprecated Jaeger exporter by sending high-cardinality telemetry data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-41078?
CVE-2026-41078 is a medium-severity denial of service vulnerability in open-telemetry OpenTelemetry.Exporter.Jaeger, published on 23 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.
Weakness: CWE-770
Which versions are affected by CVE-2026-41078?
2 open source packages ship an affected version, including OpenTelemetry.Exporter.Jaeger. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
OpenTelemetry.Exporter.Jaeger NuGet | All versions to 1.6.0-rc.1 | None |
OpenTelemetry.Exporter.Jaeger NuGet | All versions to 1.6.0-rc.1 | None |
Products include Opentelemetry Opentelemetry.
How do I fix CVE-2026-41078?
No fix has been published for CVE-2026-41078 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-41078 being exploited?
There is no known exploitation of CVE-2026-41078 in the wild and no public exploit code.
Other vulnerabilities in open-telemetry OpenTelemetry.Exporter.Jaeger
- CVE-2026-29181 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)
- CVE-2023-47108 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
- CVE-2023-45142 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics
- CVE-2023-43810 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics
- CVE-2026-39883 opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking
Sources
Also known as GHSA-38h3-2333-qx47.