The vulnerability lies in the baggage, B3 and Jaeger header parsing logic of the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators libraries, where malformed or deliberately crafted propagation headers can trigger excessive memory allocation. This weakness falls under CWE-789 – Memory Exhaustion. Although the CVE description does not specify the exact attack vector, it is inferred that an attacker could send malicious OpenTelemetry headers to a .NET application that processes these headers, resulting in a denial of service when the application runs out of memory or becomes unresponsive.

Vulnerable builds include OpenTelemetry.Api versions 0.5.0‑beta.2 through 1.15.2 and OpenTelemetry.Extensions.Propagators versions 1.3.1 through 1.15.2. Applications built against these NuGet packages could be exposed if they parse OpenTelemetry propagation headers. The issue is fixed in version 1.15.3 and later of both libraries.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score of less than 1 % suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, if an application receives untrusted network traffic containing OpenTelemetry headers, an attacker could potentially trigger the excessive memory allocation, causing a local denial of service. Updating the library mitigates the issue.