Executive brief
OpenTelemetry-Go, a library used for monitoring and tracing application performance, contains a flaw in how it processes certain web request headers. An attacker can send a specially crafted request with numerous 'baggage' headers to overwhelm the system's processor and memory. This can lead to significant application slowdowns or a complete service outage (Denial of Service).
Technical details
A resource exhaustion vulnerability (CWE-770/CWE-400) exists in OpenTelemetry-Go's baggage header extraction logic. The 'extractMultiBaggage' function in the propagation/baggage.go component independently parses each 'baggage' header field-value and aggregates them into a shared slice. While individual headers are subject to an 8192-byte limit, an attacker can bypass the intended resource constraints by sending a large number of header lines within the server's overall header limit (e.g., 1MB in default net/http). This results in excessive CPU cycles and memory allocations per request. The issue is fixed in version 1.41.0 by normalizing multi-values or enforcing a global budget.
Affected products
- OpenTelemetry opentelemetry-go >= 1.36.0, < 1.41.0
- Red Hat multicluster engine for Kubernetes 2.11
Timeline
- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched: Fixed in version 1.41.0
References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
- https://access.redhat.com/errata/RHSA-2026:25271
- https://access.redhat.com/security/cve/CVE-2026-29181
- https://bugzilla.redhat.com/show_bug.cgi?id=2456252
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json