Is CVE-2026-29181 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-29181 being exploited in the wild.

How severe is CVE-2026-29181?

High severity, with a CVSS score of 7.5, published 7 April 2026.

Which products and versions are affected?

go.opentelemetry.io/otel (Go) >= 1.36.0, = 1.36.0, < 1.41.0.

Is there a fix for CVE-2026-29181?

Yes. go.opentelemetry.io/otel (Go): upgrade to 1.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-29181 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-29181?

Check whether you run go.opentelemetry.io/otel (Go), Opentelemetry Go SDK or Opentelemetry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29181: OpenTelemetry OpenTelemetry-Go resource exhaustion in baggage header extraction

Q: Is there a fix for CVE-2026-29181?

Yes. go.opentelemetry.io/otel (Go): upgrade to 1.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-29181 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-29181?

Check whether you run go.opentelemetry.io/otel (Go), Opentelemetry Go SDK or Opentelemetry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-29181 · Severity: high · CVSS 7.5 · Published 2026-04-07

OpenTelemetry-Go, a library used for monitoring and tracing application performance, contains a flaw in how it processes certain web request headers. An attacker can send a specially crafted request with numerous 'baggage' headers to overwhelm the system's processor and memory. This can lead to significant application slowdowns or a complete service outage (Denial of Service).

Technologies: Opentelemetry Go SDK, Opentelemetry. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-29181 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-29181 being exploited in the wild.
How severe is CVE-2026-29181?: High severity, with a CVSS score of 7.5, published 7 April 2026.
Which products and versions are affected?: go.opentelemetry.io/otel (Go) >= 1.36.0, <= 1.40.0, SEMVER:introduced=1.36.0,fixed=1.41.0; Opentelemetry Go SDK >= 1.36.0, < 1.41.0.
Is there a fix for CVE-2026-29181?: Yes. go.opentelemetry.io/otel (Go): upgrade to 1.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-29181 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-29181?: Check whether you run go.opentelemetry.io/otel (Go), Opentelemetry Go SDK or Opentelemetry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/otel (Go): upgrade to 1.41.0 or later
```
go get go.opentelemetry.io/otel@v1.41.0
```

Technical details

A resource exhaustion vulnerability (CWE-770/CWE-400) exists in OpenTelemetry-Go's baggage header extraction logic. The 'extractMultiBaggage' function in the propagation/baggage.go component independently parses each 'baggage' header field-value and aggregates them into a shared slice. While individual headers are subject to an 8192-byte limit, an attacker can bypass the intended resource constraints by sending a large number of header lines within the server's overall header limit (e.g., 1MB in default net/http). This results in excessive CPU cycles and memory allocations per request. The issue is fixed in version 1.41.0 by normalizing multi-values or enforcing a global budget.

Affected products

OpenTelemetry opentelemetry-go >= 1.36.0, < 1.41.0
Red Hat multicluster engine for Kubernetes 2.11

Identifiers

CVE-2026-29181
GHSA-mh2q-q3fh-2475
GO-2026-5506

Timeline

2026-04-07: disclosed
2026-04-07: advisory
2026-04-07: patched: Fixed in version 1.41.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.