CVE-2026-29181
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
OpenTelemetry-Go versions 1.36.0 to 1.40.0 process 'baggage' headers in a way that allows an attacker to amplify CPU and memory allocation by sending many header lines, even if each value is within the 8192-byte limit.
Risk Assessment
An attacker can overload the server, causing denial of service (DoS) through excessive resource consumption.
Recommendation
Update OpenTelemetry-Go to version 1.41.0 or later.
Other vulnerabilities in OpenTelemetry-Go
See all- CVE-2026-45404Medium
OpenTelemetry-Go versions 0.11.0 through 1.44.0 have a panic vulnerability in the OpenTracing bridge due to an unsynchronized extraBaggageItems map, causing concurrent access issues and denial of service. Fixed in 1.45.0.
- CVE-2026-45287Medium
OpenTelemetry-Go prior to version 0.0.17 leaks one file descriptor on each successful `ParseFile` call. Repeated parsing in a long-running process can exhaust the file descriptor limit and cause denial of service.
- CVE-2026-41178Medium
OpenTelemetry-Go versions 1.41.0 and 1.43.0 removed raw-length rejection, causing `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
- CVE-2026-39883High
In OpenTelemetry-Go from 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.
- CVE-2026-39882Medium
The OpenTelemetry-Go library prior to version 1.43.0 reads the full HTTP response body into an in-memory buffer without a size cap, which can lead to memory exhaustion when the configured collector endpoint is attacker-controlled or when the connection is intercepted.
Original NVD description (English source)
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.