GHSA-88hf-wf7h-7w4m

Suggest an improvement
Source
https://github.com/advisories/GHSA-88hf-wf7h-7w4m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-88hf-wf7h-7w4m/GHSA-88hf-wf7h-7w4m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-88hf-wf7h-7w4m
Aliases
  • CVE-2026-41310
Published
2026-04-28T23:23:28Z
Modified
2026-05-08T19:51:02.960137Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
OpenTelemetry's Zipkin remote endpoint cache could grow without bounds and increase memory pressure
Details

Summary

The Zipkin exporter remote endpoint cache accepted unbounded key growth derived from span attributes. In high-cardinality scenarios, this could increase process memory usage over time and degrade availability.

Details

  • Introduce a bounded, thread-safe LRU cache for remote endpoints.
  • Enforce fixed maximum size to prevent unbounded growth.

Impact

  • A process using Zipkin export for client/producer spans could experience avoidable memory growth under sustained unique remote endpoint values.

Resources

#7081

Database specific 
{
    "github_reviewed_at": "2026-04-28T23:23:28Z",
    "nvd_published_at": "2026-05-06T22:16:25Z",
    "cwe_ids": [
        "CWE-400",
        "CWE-770"
    ],
    "severity": "MODERATE",
    "github_reviewed": true
}
References

Affected packages

NuGet / OpenTelemetry.Exporter.Zipkin

Package

Name
OpenTelemetry.Exporter.Zipkin
View open source insights on deps.dev
Purl
pkg:nuget/OpenTelemetry.Exporter.Zipkin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.15.3

Affected versions

1.*
1.0.0-rc2
1.0.0-rc3
1.0.0-rc4
1.0.1
1.1.0-beta1
1.1.0-beta2
1.1.0-beta3
1.1.0-beta4
1.1.0-rc1
1.1.0
1.2.0-alpha2
1.2.0-alpha3
1.2.0-alpha4
1.2.0-beta1
1.2.0-rc1
1.2.0-rc2
1.2.0-rc3
1.2.0-rc4
1.2.0-rc5
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.5.0
1.5.1
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
1.10.0
1.11.0
1.11.1
1.11.2
1.12.0
1.13.0
1.13.1
1.14.0
1.15.0
1.15.1
1.15.2

Database specific

last_known_affected_version_range 
"<= 1.15.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-88hf-wf7h-7w4m/GHSA-88hf-wf7h-7w4m.json"