CVE-2026-45292

Name of the Vulnerable Software and Affected Versions opentelemetry-java versions prior to 1.62.0

Description A flaw in the baggage propagation implementation within opentelemetry-api and opentelemetry-extension-trace-propagators allows for unbounded memory allocation and CPU consumption when parsing oversized baggage. This occurs because the W3CBaggagePropagator, JaegerPropagator, and OtTracePropator did not enforce limits on the total size or entry count of the baggage header, iterating through values regardless of length. Since baggage is automatically re-injected into outgoing requests, the impact can spread to downstream services. The risk is increased in environments where transport-layer limits are absent, such as compromised internal services using non-HTTP or custom transports.

Recommendations Update to version 1.62.0 or later. Ensure HTTP header size limits are configured at the server or gateway level.