# CVE-2026-116694: OpenTelemetry JaegerPropagator denial of service via unbounded baggage

Source: https://junglewise.ai/threats/cve-2026-116694-opentelemetry-python-provides-the-python-api-and-sdk-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116694 · Severity: medium · CVSS 4 · Published 2026-10-27

OpenTelemetry is a framework for distributed tracing that helps monitor application performance across microservices. The Jaeger propagator, an optional component used to trace requests, failed to limit the size or count of baggage values it processes from incoming requests. An attacker can send requests with numerous or oversized baggage headers, forcing the service to perform excessive CPU work and memory allocations, causing service degradation or outage.

Vendors: [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-116694 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116694 being exploited in the wild.

**How severe is CVE-2026-116694?** Medium severity, with a CVSS score of 4, published 27 October 2026.

**Which products and versions are affected?** Opentelemetry-Propagator-Jaeger before 1.45.0; opentelemetry-propagator-jaeger (PyPI) <= 1.44.0, ECOSYSTEM:introduced=0,fixed=1.45.0.

**Is there a fix for CVE-2026-116694?** Yes. opentelemetry-propagator-jaeger (PyPI): upgrade to 1.45.0 or later. Until then: Disable the optional Jaeger propagator if not required, or ensure HTTP server transport-level limits constrain inbound header size and count before the propagator processes them. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116694 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-116694?** Check whether you run Opentelemetry-Propagator-Jaeger or opentelemetry-propagator-jaeger (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- opentelemetry-propagator-jaeger (PyPI): upgrade to 1.45.0 or later

  ```sh
  pip install "opentelemetry-propagator-jaeger>=1.45.0"
  ```


Disable the optional Jaeger propagator if not required, or ensure HTTP server transport-level limits constrain inbound header size and count before the propagator processes them.

## Technical details

The JaegerPropagator.extract() method processes inbound uberctx-* baggage headers without enforcing entry count, per-entry byte, or total-byte limits, allowing an untrusted carrier to trigger unbounded CPU work and short-lived heap allocations. The vulnerability requires the optional Jaeger propagator to be enabled and affects services using custom HTTP header getters, non-HTTP transports, or raised header limits. The fix enforces W3C Baggage spec limits: 180 entries, 4096 bytes per entry, 8192 bytes total.

## Affected products

- OpenTelemetry opentelemetry-propagator-jaeger before 1.45.0

## Identifiers

- CVE-2026-116694
- GHSA-f5m9-jfrj-jjj7

## Timeline

- 2026-10-27: disclosed: CVE-2026-116694 published on NVD
- 2026-08-28: patched: Fix merged to opentelemetry-python main branch

## References

- [https://github.com/open-telemetry/opentelemetry-python/commit/65c4eeb87cd3815dc795d3b5485e9ea0d5affcc7](https://github.com/open-telemetry/opentelemetry-python/commit/65c4eeb87cd3815dc795d3b5485e9ea0d5affcc7)
- [https://github.com/open-telemetry/opentelemetry-python/pull/5556](https://github.com/open-telemetry/opentelemetry-python/pull/5556)