# CVE-2026-40182: OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

Source: https://junglewise.ai/threats/cve-2026-40182-opentelemetry-dotnet-otlp-exporter-reads-unbounded-http-response  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40182 · Severity: medium · CVSS 5.3 · Published 2026-04-23

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTTP using OpenTelemetry Protocol format (OTLP), if the request results in a unsuccessful request (i.e. HTTP 4xx or 5xx), the response is read into memory with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured back-end/collector endpoint is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned by the response. This vulnerability is fixed in 1.15.2.

Technologies: [OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet)](https://junglewise.ai/threats/technologies/opentelemetry-exporter-opentelemetryprotocol), [Opentelemetry](https://junglewise.ai/threats/technologies/opentelemetry). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-40182 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40182 being exploited in the wild.

**How severe is CVE-2026-40182?** Medium severity, with a CVSS score of 5.3, published 23 April 2026.

**Which products and versions are affected?** OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) >= 1.13.1, < 1.15.2, ECOSYSTEM:introduced=1.13.1,fixed=1.15.2.

**Is there a fix for CVE-2026-40182?** Yes. OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet): upgrade to 1.15.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-40182?** Check whether you run OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) or Opentelemetry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet): upgrade to 1.15.2 or later

  ```sh
  dotnet add package OpenTelemetry.Exporter.OpenTelemetryProtocol --version 1.15.2
  ```


## Affected products

- OpenTelemetry.Exporter.OpenTelemetryProtocol (NuGet) >= 1.13.1, < 1.15.2, ECOSYSTEM:introduced=1.13.1,fixed=1.15.2
- Opentelemetry

## Identifiers

- CVE-2026-40182
- GHSA-q834-8qmm-v933

## References

- [https://api.github.com/users/martincostello](https://api.github.com/users/martincostello)
- [https://github.com/martincostello](https://github.com/martincostello)
- [https://api.github.com/users/martincostello/gists%7B/gist_id%7D](https://api.github.com/users/martincostello/gists%7B/gist_id%7D)
- [https://api.github.com/users/martincostello/repos](https://api.github.com/users/martincostello/repos)
- [https://avatars.githubusercontent.com/u/1439341?v=4](https://avatars.githubusercontent.com/u/1439341?v=4)
- [https://api.github.com/users/martincostello/events%7B/privacy%7D](https://api.github.com/users/martincostello/events%7B/privacy%7D)

## Related threats

- [OpenTelemetry .NET OTLP Exporter insecure temporary file permissions](https://junglewise.ai/threats/cve-2026-42191-opentelemetry-net-otlp-exporter-insecure-temporary-file)
- [OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path](https://junglewise.ai/threats/cve-2026-41078-opentelemetry-net-has-potential-memory-exhaustion-via-unbounded)
- [OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers](https://junglewise.ai/threats/cve-2026-40894-opentelemetry-dotnet-excessive-memory-allocation-when-parsing)
- [OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling](https://junglewise.ai/threats/cve-2026-40891-opentelemetry-dotnet-unbounded-grpc-status-details-bin-parsing-in)
- [OpenTelemetry OpenTelemetry-Go untrusted search path in host ID detection](https://junglewise.ai/threats/cve-2026-39883-opentelemetry-opentelemetry-go-untrusted-search-path-in-host-id)