Is CVE-2026-116694 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116694 being exploited in the wild.

How severe is CVE-2026-116694?

Medium severity, with a CVSS score of 4, published 27 October 2026.

Which products and versions are affected?

Opentelemetry-Propagator-Jaeger before 1.45.0; opentelemetry-propagator-jaeger (PyPI) <= 1.44.0, ECOSYSTEM:introduced=0,fixed=1.45.0.

How is CVE-2026-116694 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116694?

Check whether you run Opentelemetry-Propagator-Jaeger or opentelemetry-propagator-jaeger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116694: OpenTelemetry JaegerPropagator denial of service via unbounded baggage

Q: Is there a fix for CVE-2026-116694?

Yes. opentelemetry-propagator-jaeger (PyPI): upgrade to 1.45.0 or later. Until then: Disable the optional Jaeger propagator if not required, or ensure HTTP server transport-level limits constrain inbound header size and count before the propagator processes them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-116694 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-116694?

Check whether you run Opentelemetry-Propagator-Jaeger or opentelemetry-propagator-jaeger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116694 · Severity: medium · CVSS 4 · Published 2026-10-27

OpenTelemetry is a framework for distributed tracing that helps monitor application performance across microservices. The Jaeger propagator, an optional component used to trace requests, failed to limit the size or count of baggage values it processes from incoming requests. An attacker can send requests with numerous or oversized baggage headers, forcing the service to perform excessive CPU work and memory allocations, causing service degradation or outage.

Vendors: Opentelemetry, PyPI.

Quick answers

Is CVE-2026-116694 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116694 being exploited in the wild.
How severe is CVE-2026-116694?: Medium severity, with a CVSS score of 4, published 27 October 2026.
Which products and versions are affected?: Opentelemetry-Propagator-Jaeger before 1.45.0; opentelemetry-propagator-jaeger (PyPI) <= 1.44.0, ECOSYSTEM:introduced=0,fixed=1.45.0.
Is there a fix for CVE-2026-116694?: Yes. opentelemetry-propagator-jaeger (PyPI): upgrade to 1.45.0 or later. Until then: Disable the optional Jaeger propagator if not required, or ensure HTTP server transport-level limits constrain inbound header size and count before the propagator processes them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116694 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116694?: Check whether you run Opentelemetry-Propagator-Jaeger or opentelemetry-propagator-jaeger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

opentelemetry-propagator-jaeger (PyPI): upgrade to 1.45.0 or later
```
pip install "opentelemetry-propagator-jaeger>=1.45.0"
```

Disable the optional Jaeger propagator if not required, or ensure HTTP server transport-level limits constrain inbound header size and count before the propagator processes them.

Technical details

The JaegerPropagator.extract() method processes inbound uberctx-* baggage headers without enforcing entry count, per-entry byte, or total-byte limits, allowing an untrusted carrier to trigger unbounded CPU work and short-lived heap allocations. The vulnerability requires the optional Jaeger propagator to be enabled and affects services using custom HTTP header getters, non-HTTP transports, or raised header limits. The fix enforces W3C Baggage spec limits: 180 entries, 4096 bytes per entry, 8192 bytes total.

Affected products

OpenTelemetry opentelemetry-propagator-jaeger before 1.45.0

Identifiers

CVE-2026-116694
GHSA-f5m9-jfrj-jjj7

Timeline

2026-10-27: disclosed: CVE-2026-116694 published on NVD
2026-08-28: patched: Fix merged to opentelemetry-python main branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.