GitHub Advisoryadvisory · NuGet

GHSA-88hf-wf7h-7w4m OpenTelemetry's Zipkin remote endpoint cache could grow without bounds and increase memory pressure

MEDIUM Published 2026-04-28 Modified 2026-05-08 Official page ↗
Aliases
CVE-2026-41310
Ecosystem
NuGet
Packages
OpenTelemetry.Exporter.Zipkin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2026-04-28

Affected packages

• NuGet OpenTelemetry.Exporter.Zipkin: < 1.15.3 → fixed in 1.15.3

Description

Summary The Zipkin exporter remote endpoint cache accepted unbounded key growth derived from span attributes. In high-cardinality scenarios, this could increase process memory usage over time and degrade availability. Details • Introduce a bounded, thread-safe LRU cache for remote endpoints. • Enforce fixed maximum size to prevent unbounded growth. Impact • A process using Zipkin export for client/producer spans could experience avoidable memory growth under sustained unique remote endpoint values. Resources #7081

Related

Alias · CVE (1)

  • CVE-2026-41310 OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References