Is CVE-2026-40894 actively exploited?

CVE-2026-40894 has no public evidence of in-the-wild exploitation as of 2026-04-28.

What is the CVSS score for CVE-2026-40894?

CVE-2026-40894 has a CVSS score of 5.3 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

How do I patch CVE-2026-40894?

Patch guidance is available from opentelemetry security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-40894.

CVE-2026-40894 - remediation guidance & executive summary

Q: Which products are affected by CVE-2026-40894?

3 products: opentelemetry opentelemetry, opentelemetry opentelemetry.api, opentelemetry opentelemetry.extensions.propagators.

Description

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: low
Weaknesses: CWE-789

Metadata

Primary Vendor: OPENTELEMETRY
Published: 4/23/2026
Last Modified: 4/28/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

opentelemetry : opentelemetryopentelemetry : opentelemetry.apiopentelemetry : opentelemetry.extensions.propagators

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-40894. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-40894

View on NIST NVD

CVE-2026-40894 vulnerability