The OpenTelemetry.Exporter.Zipkin component in opentelemetry-dotnet versions up to 1.15.2 suffers from unbounded resource allocation in its remote endpoint cache. This cache accepts keys derived from span attributes without limits, leading to uncontrolled memory growth under sustained high-cardinality conditions. This can degrade application availability due to increased memory usage. The issue is addressed in version 1.15.3 by implementing a bounded, thread-safe Least Recently Used (LRU) cache with a fixed maximum size to limit memory consumption.

This vulnerability can cause increased memory usage and potential degradation of availability in processes using the Zipkin exporter for client or producer spans under high-cardinality conditions. There is no impact on confidentiality or integrity. No known exploits are reported in the wild.

Upgrade to opentelemetry-dotnet version 1.15.3 or later, which includes a fix by introducing a bounded, thread-safe LRU cache for remote endpoints. Patch status is not explicitly confirmed in the vendor advisory, but the fix is included in version 1.15.3. Until upgraded, users may experience memory growth under certain conditions.