The OpenTelemetry.Exporter.Zipkin component in opentelemetry-dotnet versions up to 1.15.2 has a resource allocation vulnerability (CWE-770) where the remote endpoint cache grows without bounds when processing span attributes with high cardinality. This unbounded cache growth can lead to increased memory usage over time, impacting process stability and availability. The vulnerability is addressed in version 1.15.3 by implementing a fixed-size, thread-safe LRU cache to limit memory consumption.

This vulnerability can cause a process using the Zipkin exporter to consume increasing amounts of memory under sustained high-cardinality remote endpoint values, potentially leading to degraded availability or process instability. There is no impact on confidentiality or integrity, only availability is affected.

A fix is available in opentelemetry-dotnet version 1.15.3, which introduces a bounded, thread-safe LRU cache to prevent unbounded memory growth. Users should upgrade to version 1.15.3 or later to remediate this issue. Patch status is not explicitly stated in the vendor advisory content provided, but the description confirms the fix is implemented in 1.15.3.