OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.11.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- open-telemetry opentelemetry-dotnet
From 1.10.0-beta.1 · fixed in 1.11.2
- OpenTelemetry.ApiNuGet
From 1.11.0 · fixed in 1.11.2
- OpenTelemetry.ApiNuGet
1.10.0
- OpenTelemetry.ApiNuGet
1.10.0-beta.1
- OpenTelemetry.ApiNuGet
1.10.0-rc.1
- OpenTelemetry.ApiNuGet
1.11.0-rc.1