CVE-2026-40894 OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

[
  {
    "vendor": "open-telemetry",
    "product": "opentelemetry-dotnet",
    "versions": [
      {
        "version": ">= 0.5.0-beta.2, < 1.15.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "open-telemetry",
    "product": "OpenTelemetry.Api",
    "versions": [
      {
        "version": ">= 0.5.0-beta.2, < 1.15.3",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "open-telemetry",
    "product": "OpenTelemetry.Extensions.Propagators",
    "versions": [
      {
        "version": ">= 1.3.1, < 1.15.3",
        "status": "affected"
      }
    ]
  }
]