Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol@1.8.1
purl pkg:nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol@1.8.1
Next non-vulnerable version 1.15.3
Latest non-vulnerable version 1.15.3
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-scbv-9xb1-kfa8
Aliases:
CVE-2026-42191
GHSA-4625-4j76-fww9
OpenTelemetry.Exporter.OpenTelemetryProtocol is the OTLP (OpenTelemetry Protocol) exporter implementation. From 1.8.0 to 1.15.2, the OTLP disk retry feature in OpenTelemetry.Exporter.OpenTelemetryProtocol silently fell back to Path.GetTempPath() when OTEL_DOTNET_EXPERIMENTAL_OTLP_RETRY=disk was set but OTEL_DOTNET_EXPERIMENTAL_OTLP_DISK_RETRY_DIRECTORY_PATH was not configured. The exporter stored and loaded *.blob files under fixed, signal-named subdirectories (traces, metrics, logs) beneath that shared temporary root path. On multi-user systems where the temporary directory is accessible to other local accounts, this allows an attacker to write crafted *.blob files, read *.blob files written by the application between export failures, or deposit numerous or oversized blob files, degrading retry-loop performance or consuming disk space. This vulnerability is fixed in 1.15.3.
1.15.3
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T22:17:05.358641+00:00 GitLab Importer Affected by VCID-scbv-9xb1-kfa8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/OpenTelemetry.Exporter.OpenTelemetryProtocol/CVE-2026-42191.yml 38.6.0