OpenTelemetry.Exporter.Zipkin in .NET versions 1.15.2 and earlier stores remote endpoint information in an unbounded cache whose keys are derived from span attributes. When a process generates many unique span attributes—especially in high‑cardinality scenarios—the cache grows without limit, causing the process memory usage to increase over time and potentially leading to resource exhaustion. This flaw is a form of uncontrolled resource consumption (CWE‑400, CWE‑770) rather than an authentication bypass or code‑execution bug.

The vulnerability affects the OpenTelemetry .NET Zipkin exporter, a component of the open‑telemetry:opentelemetry-dotnet product. All releases up to and including 1.15.2 are affected; versions 1.15.3 and later contain a bounded, thread‑safe LRU cache that limits the number of cached endpoints.

The reported CVSS score of 5.3 indicates medium severity, and the EPSS score is not available, suggesting no high exploitation probability data. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. The likely attack vector involves a client or producer application that emits traces with a large variety of span attributes, causing sustained growth of the internal cache. A malicious actor could craft such high‑cardinality spans to trigger the memory surge, potentially exhausting resources and impacting service availability.