OpenTelemetry.Extensions.Propagators
OpenTelemetry Extensions Propagators
Activity
- Latest release
- 3w ago
- Total releases
- 54
- Cadence
- ~20 days
- Last 12 months
- 14
Details
- License
- Apache-2.0
- First release
- Jun 01, 2022
| Version | Released | |
|---|---|---|
1.18.0
minor
|
1.18.0
minor
Dependencies (1)
|
|
1.18.0-rc.1
pre
|
1.18.0-rc.1
pre
Dependencies (1)
|
|
1.17.0
minor
|
1.17.0
minor
Dependencies (1)
|
|
1.17.0-rc.1
pre
|
1.17.0-rc.1
pre
Dependencies (1)
|
|
1.16.0
minor
|
1.16.0
minor
Dependencies (1)
|
|
1.16.0-rc.1
pre
|
1.16.0-rc.1
pre
Dependencies (1)
|
|
1.15.3
patch
|
1.15.3
patch
Dependencies (1)
|
|
1.15.2
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.15.2
patch
Dependencies (1)
|
|
1.15.1
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.15.1
patch
Dependencies (1)
|
|
1.15.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.15.0
minor
Dependencies (1)
|
|
1.14.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.14.0
minor
Dependencies (1)
|
|
1.14.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.14.0-rc.1
pre
Dependencies (1)
|
|
1.13.1
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.13.1
patch
Dependencies (1)
|
|
1.13.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.13.0
minor
Dependencies (1)
|
|
1.12.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.12.0
minor
Dependencies (1)
|
|
1.11.2
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.11.2
patch
Dependencies (1)
|
|
1.11.1
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.11.1
patch
Dependencies (1)
|
|
1.11.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.11.0
minor
Dependencies (1)
|
|
1.11.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.11.0-rc.1
pre
Dependencies (1)
|
|
1.10.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.10.0
minor
Dependencies (1)
|
|
1.10.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.10.0-rc.1
pre
Dependencies (1)
|
|
1.10.0-beta.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.10.0-beta.1
pre
Dependencies (1)
|
|
1.9.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.9.0
minor
Dependencies (1)
|
|
1.9.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.9.0-rc.1
pre
Dependencies (1)
|
|
1.9.0-alpha.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.9.0-alpha.1
pre
Dependencies (1)
|
|
1.8.1
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.8.1
patch
Dependencies (1)
|
|
1.8.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.8.0
minor
Dependencies (1)
|
|
1.8.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.8.0-rc.1
pre
Dependencies (1)
|
|
1.8.0-beta.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.8.0-beta.1
pre
Dependencies (1)
|
|
1.7.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.7.0
minor
Dependencies (1)
|
|
1.7.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.7.0-rc.1
pre
Dependencies (1)
|
|
1.7.0-alpha.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.7.0-alpha.1
pre
Dependencies (1)
|
|
1.6.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.6.0
minor
Dependencies (1)
|
|
1.6.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.6.0-rc.1
pre
Dependencies (1)
|
|
1.6.0-alpha.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.6.0-alpha.1
pre
Dependencies (1)
|
|
1.5.1
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.5.1
patch
Dependencies (1)
|
|
1.5.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.5.0
minor
Dependencies (1)
|
|
1.5.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.5.0-rc.1
pre
Dependencies (1)
|
|
1.5.0-alpha.2
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.5.0-alpha.2
pre
Dependencies (1)
|
|
1.5.0-alpha.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.5.0-alpha.1
pre
Dependencies (1)
|
|
1.4.0
minor
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0
minor
Dependencies (1)
|
|
1.4.0-rc.4
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0-rc.4
pre
Dependencies (1)
|
|
1.4.0-rc.3
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0-rc.3
pre
Dependencies (1)
|
|
1.4.0-rc.2
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0-rc.2
pre
Dependencies (1)
|
|
1.3.2
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.3.2
patch
Dependencies (1)
|
|
1.4.0-rc.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0-rc.1
pre
Dependencies (1)
|
|
1.4.0-beta.3
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0-beta.3
pre
Dependencies (1)
|
|
1.4.0-beta.2
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0-beta.2
pre
Dependencies (1)
|
|
1.4.0-beta.1
pre
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.4.0-beta.1
pre
Dependencies (1)
|
|
1.3.1
patch
1 CVE
CVE-2026-40894
GHSA-g94r-2vxg-569j
Apr 23, 2026
OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
5.3
/ 10
Medium
Network
Low
None
None
Unchanged
None
None
Low
SummaryThe implementation details of the baggage, B3 and Jaeger processing code in the DetailsExceeding Limits
This change was introduced by #1048. Excessive allocationThe following methods eagerly allocate intermediate arrays before applying size limits.
ImpactExcessively large propagation headers, particularly in degenerate/malformed cases that consist or large numbers of delimiter characters, can allocate excessive amounts of memory for intermediate storage of parsed content relative to the size of the original input. MitigationHTTP servers often set maximum limits on the length of HTTP request headers, such as Internet Information Services (IIS) which sets a default limit of 16KB and nginx which sets a default limit of 8KB. WorkaroundsPossible workarounds include:
Remediation#7061 refactors the handling of baggage, B3 and Jaeger propagation headers to stop parsing eagerly when limits are exceeded and avoid allocating intermediate arrays. Affected versions
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2
1.3.1
+ 9 more Show less
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
Fixed in
1.15.3
References
Updated Sep 10, 2026 · Source: OSV.dev |
1.3.1
patch
Dependencies (1)
|