CVE-2025-27513

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27513
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27513.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27513
Aliases
Related
Published
2025-03-05T18:12:25.867Z
Modified
2026-08-12T03:51:46.886772736Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package
Details

OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when a tracestate and traceparent header is received. Even if an application does not explicitly use trace context propagation, receiving these headers can still trigger high CPU usage. This issue impacts any application accessible over the web or backend services that process HTTP requests containing a tracestate header. Application may experience excessive resource consumption, leading to increased latency, degraded performance, or downtime. This vulnerability is fixed in 1.11.2.

Database specific 
{
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27513.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-dotnet

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-dotnet
Events
Introduced
a5fa611774b6e63c2189cba7b5417a0d496df95c
Fixed
1b555c1201413f2f55f2cd3c4ba03ef4b615b6b5
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.10.0-beta.1"
        },
        {
            "fixed": "1.11.2"
        }
    ]
}

Affected versions

core-1.*
core-1.11.0
core-1.11.0-rc.1
core-1.11.1
coreunstable-1.*
coreunstable-1.10.0-beta.1
coreunstable-1.11.0-beta.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27513.json"