CVE-2026-48504

Name of the Vulnerable Software and Affected Versions OpenTelemetry Rust versions 0.32.0 and earlier

Description The BaggagePropagator::extract with context function in opentelemetry sdk fails to enforce W3C Baggage size limits before parsing an inbound baggage header. An attacker can provide a large header to cause excessive CPU usage and short-lived heap allocations during the parsing of entries that are subsequently discarded by the SDK storage limits. This can lead to increased per-request resource usage and potential denial-of-service for services accepting untrusted inbound propagation headers, particularly if transport-level header limits are absent or exceed W3C standards.

Recommendations Update OpenTelemetry Rust to version 0.32.1. As a temporary workaround, reject or limit inbound baggage headers larger than 8192 bytes at a proxy, gateway, middleware layer, or custom carrier boundary before invoking OpenTelemetry propagation extraction.