CVE-2026-41310 OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth
An attacker can cause memory exhaustion in applications using the OpenTelemetry .NET Zipkin exporter by sending high-cardinality span attributes, leading to service degradation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41310?
CVE-2026-41310 is a medium-severity denial of service vulnerability in open-telemetry opentelemetry-dotnet, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios, a process using Zipkin export for client or producer spans could experience avoidable memory growth under sustained unique remote endpoint values, increasing process memory usage over time and degrading availability. This issue is fixed in version 1.15.3, which introduces a bounded, thread-safe LRU cache for remote endpoints with a fixed maximum size.
Which versions are affected by CVE-2026-41310?
2 open source packages ship an affected version, including OpenTelemetry.Exporter.Zipkin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
OpenTelemetry.Exporter.Zipkin NuGet | All versions | 1.15.3 |
OpenTelemetry.Exporter.Zipkin NuGet | All versions | 1.15.3 |
Products include Opentelemetry Opentelemetry.exporter.zipkin.
How do I fix CVE-2026-41310?
Upgrade OpenTelemetry.Exporter.Zipkin to 1.15.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-41310 being exploited?
There is no known exploitation of CVE-2026-41310 in the wild and no public exploit code.
Sources
Also known as GHSA-88hf-wf7h-7w4m.