CVE-2026-29181

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 1.36.0 through 1.40.0

Description The OpenTelemetry-Go implementation is susceptible to a remote request amplification issue due to the way it handles multi-value baggage headers. Specifically, the extractMultiBaggage function in propagation/baggage.go parses each baggage header field-value independently and aggregates the results. An attacker can exploit this by sending numerous baggage header lines, even if each individual value is within the 8192-byte limit, leading to increased CPU usage and memory allocations. This can result in higher latency and potential denial-of-service conditions. The vulnerability is related to the parsing of headers received in HTTP requests. The vulnerable function is extractMultiBaggage.

Recommendations Update to version 1.41.0 or later.