OpenTelemetry dotnet’s OTLP exporter can read an entire HTTP response into memory when the backend returns a 4xx or 5xx status code, without imposing an upper limit on the data size. This unbounded allocation may exhaust application memory and cause the process to fail or become unresponsive. The impact is a loss of availability for the affected application, without directly compromising confidentiality or integrity.

The vulnerability affects the open-telemetry:opentelemetry-dotnet product, specifically versions from 1.13.1 through 1.15.1. The problem was resolved in version 1.15.2.

The CVSS score of 5.3 places the flaw in the medium severity range, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker or a MitM adversary to control the backend or collector endpoint and to return an unusually large response body upon an error status, leading to memory exhaustion.