CVE-2026-41310 — OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter

title: Potential Memory Exhaustion via OpenTelemetry Zipkin Exporter Cache Growth - CVE-2026-41310
id: scw-2026-05-06-ai-1
status: experimental
level: medium
description: |
  This rule detects the execution of .NET processes that are likely using the vulnerable OpenTelemetry.Exporter.Zipkin component (versions 1.15.2 and earlier). The vulnerability allows for unbounded memory growth due to an unmanaged cache of remote endpoints, potentially leading to denial of service. This detection focuses on identifying the presence of the Zipkin exporter in the command line, indicating a potential target for this vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41310/
tags:
  - attack.resource_development
  - attack.t1499
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\dotnet\dotnet.exe'
      CommandLine|contains:
          - 'OpenTelemetry.Exporter.Zipkin'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse