CVE-2026-116694

Name of the Vulnerable Software and Affected Versions opentelemetry-propagator-jaeger versions prior to 1.45.0

Description The JaegerPropagator.extract() function in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without enforcing entry, per-entry byte, or total-byte limits. When an untrusted carrier provides numerous or oversized values, it can lead to excessive CPU usage and short-lived heap allocations. This can result in a denial of service if transport-level limits do not constrain the input. The risk is increased for non-HTTP transports, custom TextMapGetter implementations, or environments where server and gateway header limits have been raised or disabled.

Recommendations Update opentelemetry-propagator-jaeger to version 1.45.0 or later.