OpenTelemetry dotnet versions from 1.13.1 to before 1.15.2 contain a memory allocation vulnerability (CWE-789) when handling unsuccessful HTTP responses during telemetry export using OTLP over gRPC or HTTP. Specifically, the response body is read into memory without an upper bound on size, potentially causing memory exhaustion if the response is excessively large. This can occur if the backend or collector endpoint is malicious or if a man-in-the-middle attacker can inject a large response. The vulnerability is addressed in version 1.15.2.

An attacker controlling the backend/collector endpoint or able to perform a man-in-the-middle attack can cause the consuming application to allocate excessive memory by returning a very large response body on an unsuccessful telemetry export request. This can lead to memory exhaustion and potentially cause application instability or denial of service. There is no impact on confidentiality or integrity reported.

This vulnerability is fixed in OpenTelemetry dotnet version 1.15.2. Users should upgrade to version 1.15.2 or later to remediate this issue. No other official remediation or temporary fix is documented. Until upgrading, avoid using untrusted or attacker-controlled backends or collectors for telemetry export.