Technical impact
The Jaeger exporter in OpenTelemetry dotnet inflates its internal pooled‑list sizing based on the number of spans and tags observed. When a user or attacker supplies telemetry with very high cardinality, the list grows without bounds and the enlarged size is then reused by subsequent allocations. This sustained increase in memory consumption can deplete an application’s heap and result in denial of service. The flaw is a classic unbounded allocation weakness marked as CWE‑770 and is present in all releases 1.6.0‑rc.1 and earlier.
Affected Systems
The affected components are the OpenTelemetry.Exporter.Jaeger library and the opentelemetry-dotnet SDK, both maintained by the OpenTelemetry project. Versions 1.6.0‑rc.1 and earlier are vulnerable; the Jaeger exporter was deprecated in 2023, so newer releases no longer include the vulnerable code.
Risk and Exploitability
The CVSS score of 5.9 indicates moderate severity, while the EPSS score of less than 1% reflects a very low exploitation probability at the time of analysis. The vulnerability is not listed in CISA’s KEV catalog. Because the attack requires the attacker to influence the content of telemetry streams, the likely vector is an application or infrastructure component that accepts untrusted telemetry data. There is no official fix, so the risk persists until the exporter is removed or the application mitigates cardinality of telemetry.
Github GHSA