CVE-2026-128086

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.0.0-RC1 through 1.46.9

Description OpenTelemetry-Go eagerly materializes W3C baggage metadata into property objects during parsing. This process involves slice growth, serialization, and copying into internal representations, which causes memory-allocation amplification when processing a valid, densely populated header. For example, a valid 8,191-byte input containing 4,094 properties can result in approximately 778 KB of cumulative allocation per parse. This issue can increase allocation and garbage-collection pressure, potentially impacting performance, although reliable process termination or complete denial of service has not been established. Remote exploitation is possible if baggage extraction is enabled, attacker-controlled input reaches the system, and extraction occurs before authentication or on a public route.

The issue is triggered via the following entry points:

The underlying cause is located in the parseMember function, where properties are eagerly materialized and copied into internal/baggage.Item.

Recommendations Update OpenTelemetry-Go to version 1.47.0. As a temporary mitigation, ensure that authentication is performed before baggage extraction to prevent unauthenticated users from triggering the allocation amplification. Restrict the use of baggage.Parse and propagation.Baggage.Extract on public routes or unauthenticated inputs.