CVE-2026-40891: OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

April 23, 2026

When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS).

References

github.com/advisories/GHSA-mr8r-92fq-pj8p
github.com/open-telemetry/opentelemetry-dotnet/pull/5980
github.com/open-telemetry/opentelemetry-dotnet/pull/7064
github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-mr8r-92fq-pj8p
nvd.nist.gov/vuln/detail/CVE-2026-40891

Code Behaviors & Features

Detect and mitigate CVE-2026-40891 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →