OpenTelemetry.Api

OpenTelemetry .NET API

View on Nuget

Activity

Latest release: 3w ago
Total releases: 83
Cadence: ~19 days
Last 12 months: 14

Details

License: Apache-2.0
First release: Nov 05, 2019

Releases

Version	Released
`1.18.0` minor	Aug 21, 2026
`1.18.0-rc.1` pre	Aug 21, 2026
`1.17.0` minor	Jul 16, 2026
`1.17.0-rc.1` pre	Jul 16, 2026
`1.16.0` minor	Jun 10, 2026
`1.16.0-rc.1` pre	Jun 10, 2026
`1.15.3` patch	Apr 21, 2026
`1.15.2` patch 1 CVE	Apr 08, 2026
`1.15.1` patch 1 CVE	Mar 27, 2026
`1.15.0` minor 1 CVE	Jan 21, 2026
`1.14.0` minor 1 CVE	Nov 12, 2025
`1.14.0-rc.1` pre 1 CVE	Oct 21, 2025
`1.13.1` patch 1 CVE	Oct 09, 2025
`1.13.0` minor 1 CVE	Oct 01, 2025
`1.12.0` minor 1 CVE	Apr 30, 2025
`1.11.2` minor 1 CVE	Mar 04, 2025
`1.9.0` minor 1 CVE	Jun 14, 2024
`1.9.0-rc.1` pre 1 CVE	Jun 07, 2024
`1.9.0-alpha.1` pre 1 CVE	May 20, 2024
`1.8.1` patch 1 CVE	Apr 18, 2024
`1.8.0` minor 1 CVE	Apr 03, 2024
`1.8.0-rc.1` pre 1 CVE	Mar 27, 2024
`1.8.0-beta.1` pre 1 CVE	Mar 14, 2024
`1.7.0` minor 1 CVE	Dec 09, 2023
`1.7.0-rc.1` pre 1 CVE	Nov 30, 2023
`1.7.0-alpha.1` pre 1 CVE	Oct 17, 2023
`1.6.0` minor 1 CVE	Sep 06, 2023
`1.6.0-rc.1` pre 1 CVE	Aug 21, 2023
`1.6.0-alpha.1` pre 1 CVE	Jul 12, 2023
`1.5.1` patch 1 CVE	Jun 26, 2023
`1.5.0` minor 1 CVE	Jun 06, 2023
`1.5.0-rc.1` pre 1 CVE	May 26, 2023
`1.5.0-alpha.2` pre 1 CVE	Apr 01, 2023
`1.5.0-alpha.1` pre 1 CVE	Mar 08, 2023
`1.4.0` minor 1 CVE	Feb 24, 2023
`1.4.0-rc.4` pre 1 CVE	Feb 11, 2023
`1.4.0-rc.3` pre 1 CVE	Feb 02, 2023
`1.4.0-rc.2` pre 1 CVE	Jan 09, 2023
`1.3.2` patch 1 CVE	Dec 20, 2022
`1.4.0-rc.1` pre 1 CVE	Dec 12, 2022
`1.4.0-beta.3` pre 1 CVE	Nov 07, 2022
`1.4.0-beta.2` pre 1 CVE	Oct 17, 2022
`1.4.0-beta.1` pre 1 CVE	Sep 30, 2022
`1.3.1` patch 1 CVE	Sep 08, 2022
`1.4.0-alpha.2` pre 1 CVE	Aug 18, 2022
`1.4.0-alpha.1` pre 1 CVE	Aug 03, 2022
`1.3.0` minor 1 CVE	Jun 03, 2022
`1.3.0-rc.2` pre 1 CVE	Jun 01, 2022
`1.3.0-beta.2` pre 1 CVE	May 17, 2022
`1.3.0-beta.1` pre 1 CVE	Apr 20, 2022

1–50 of 83

Dependencies (1)

Depends on

1.18.0

Used by

835

Supply-chain exposure

835 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (2)

CVE-2026-40894 GHSA-g94r-2vxg-569j Apr 23, 2026

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

5.3 / 10
Medium
Network Low None None Unchanged None None Low

Summary

The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application.

Details

Exceeding Limits

BaggagePropagator.Inject<T>() does not enforce the length limit of 8192 characters if the injected baggage contains only one item.

This change was introduced by #1048.

Excessive allocation

The following methods eagerly allocate intermediate arrays before applying size limits.

BaggagePropagator.Extract<T>() - this change was introduced by #1048.

BaggagePropagator.Inject<T>() - this change was introduced by #1048.

B3Propagator.Extract<T>() - this change was introduced by #533.

B3Propagator.Extract<T>() - this change was introduced by #3244.

JaegerPropagator.Extract<T>() - this change was introduced by #3309.

Impact

Excessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input.

Mitigation

HTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB.

Workarounds

Possible workarounds include:

Configuring appropriate HTTP request header limits.

Disabling baggage and/or trace propagation.

Remediation

#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays.

Affected versions

1.0.0-rc21.0.0-rc31.0.0-rc41.0.11.1.01.1.0-beta11.1.0-beta21.1.0-beta31.1.0-beta41.1.0-rc11.10.01.11.0

+ 26 more Show less

1.11.11.11.21.12.01.13.01.13.11.14.01.15.01.15.11.15.21.2.01.2.0-rc11.2.0-rc21.2.0-rc31.2.0-rc41.2.0-rc51.3.01.3.11.3.21.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.0

Fixed in

1.15.3

References

https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-g94r-2vxg-569j
https://nvd.nist.gov/vuln/detail/CVE-2026-40894
https://github.com/open-telemetry/opentelemetry-dotnet/pull/1048
https://github.com/open-telemetry/opentelemetry-dotnet/pull/3244
https://github.com/open-telemetry/opentelemetry-dotnet/pull/3309
https://github.com/open-telemetry/opentelemetry-dotnet/pull/3533

Updated Sep 10, 2026 · Source: OSV.dev
CVE-2025-27513 GHSA-8785-wc3w-h8q6 Mar 05, 2025

OpenTelemetry .NET has Denial of Service (DoS) Vulnerability in API Package

6.5 / 10
Medium
Network Low None Required Unchanged None None High

Impact

What kind of vulnerability is it? Who is impacted?

A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received.

Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage.

This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header.

Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime.

Patches

Has the problem been patched? What versions should users upgrade to?

This issue has been resolved in OpenTelemetry.Api 1.11.2 by reverting the change that introduced the problematic behavior in versions 1.10.0 to 1.11.1.The fix ensures that valid tracing headers no longer cause excessive CPU consumption when received in requests.Fixed Version: OpenTelemetry .NET Version | Status -- | -- <= 1.9.x | ✅ Not affected 1.10.0 - 1.11.1 | ❌ Vulnerable 1.11.2 (Fixed) | ✅ Safe to use

Upgrade Command:

dotnet add package OpenTelemetry --version 1.11.2

Delisting of Affected Packages To prevent accidental usage, we have delisted the affected versions (1.10.0 to 1.11.1) from NuGet. Users should avoid these versions and upgrade to 1.11.2 immediately.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

References

Are there any links users can visit to find out more?

Affected versions

1.11.01.11.11.10.01.10.0-beta.11.10.0-rc.11.11.0-rc.1

Fixed in

1.11.2

References

https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-8785-wc3w-h8q6
https://nvd.nist.gov/vuln/detail/CVE-2025-27513
https://github.com/open-telemetry/opentelemetry-dotnet/pull/6161
https://github.com/open-telemetry/opentelemetry-dotnet/commit/1b555c1201413f2f55f2cd3c4ba03ef4b615b6b5
https://github.com/open-telemetry/opentelemetry-dotnet

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 17
patch 8
pre 57

83 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More