# CVE-2026-41078: OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

Source: https://junglewise.ai/threats/cve-2026-41078-opentelemetry-net-has-potential-memory-exhaustion-via-unbounded  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-23. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-41078 · Severity: medium · CVSS 5.9 · Published 2026-04-23

OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.

Technologies: [Opentelemetry](https://junglewise.ai/threats/technologies/opentelemetry). Vendors: [NuGet](https://junglewise.ai/threats/vendors/nuget), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-41078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41078 being exploited in the wild.

**How severe is CVE-2026-41078?** Medium severity, with a CVSS score of 5.9, published 23 April 2026.

**Which products and versions are affected?** OpenTelemetry.Exporter.Jaeger (NuGet) <= 1.6.0-rc.1, ECOSYSTEM:introduced=0,last_affected=1.6.0-rc.1.

**Is there a fix for CVE-2026-41078?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-41078?** Check whether you run OpenTelemetry.Exporter.Jaeger (NuGet) or Opentelemetry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- OpenTelemetry.Exporter.Jaeger (NuGet) <= 1.6.0-rc.1, ECOSYSTEM:introduced=0,last_affected=1.6.0-rc.1
- Opentelemetry

## Identifiers

- CVE-2026-41078
- GHSA-38h3-2333-qx47

## References

- [https://api.github.com/users/Kielek](https://api.github.com/users/Kielek)
- [https://github.com/Kielek](https://github.com/Kielek)
- [https://api.github.com/users/Kielek/gists%7B/gist_id%7D](https://api.github.com/users/Kielek/gists%7B/gist_id%7D)
- [https://api.github.com/users/Kielek/repos](https://api.github.com/users/Kielek/repos)
- [https://avatars.githubusercontent.com/u/5972917?v=4](https://avatars.githubusercontent.com/u/5972917?v=4)
- [https://api.github.com/users/Kielek/events%7B/privacy%7D](https://api.github.com/users/Kielek/events%7B/privacy%7D)

## Related threats

- [OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers](https://junglewise.ai/threats/cve-2026-40894-opentelemetry-dotnet-excessive-memory-allocation-when-parsing)
- [OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling](https://junglewise.ai/threats/cve-2026-40891-opentelemetry-dotnet-unbounded-grpc-status-details-bin-parsing-in)
- [OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies](https://junglewise.ai/threats/cve-2026-40182-opentelemetry-dotnet-otlp-exporter-reads-unbounded-http-response)
- [OpenTelemetry OpenTelemetry-Go untrusted search path in host ID detection](https://junglewise.ai/threats/cve-2026-39883-opentelemetry-opentelemetry-go-untrusted-search-path-in-host-id)
- [OpenTelemetry-Go memory exhaustion in OTLP HTTP exporters](https://junglewise.ai/threats/cve-2026-39882-opentelemetry-go-memory-exhaustion-in-otlp-http-exporters)