# CVE-2026-29181: OpenTelemetry OpenTelemetry-Go resource exhaustion in baggage header extraction

Source: https://junglewise.ai/threats/cve-2026-29181-opentelemetry-opentelemetry-go-resource-exhaustion-in-baggage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-07. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-29181 · Severity: high · CVSS 7.5 · Published 2026-04-07

OpenTelemetry-Go, a library used for monitoring and tracing application performance, contains a flaw in how it processes certain web request headers. An attacker can send a specially crafted request with numerous 'baggage' headers to overwhelm the system's processor and memory. This can lead to significant application slowdowns or a complete service outage (Denial of Service).

Technologies: [Opentelemetry Go SDK](https://junglewise.ai/threats/technologies/go-sdk), [Opentelemetry](https://junglewise.ai/threats/technologies/opentelemetry). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-29181 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-29181 being exploited in the wild.

**How severe is CVE-2026-29181?** High severity, with a CVSS score of 7.5, published 7 April 2026.

**Which products and versions are affected?** go.opentelemetry.io/otel (Go) >= 1.36.0, <= 1.40.0, SEMVER:introduced=1.36.0,fixed=1.41.0; Opentelemetry Go SDK >= 1.36.0, < 1.41.0.

**Is there a fix for CVE-2026-29181?** Yes. go.opentelemetry.io/otel (Go): upgrade to 1.41.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-29181 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-29181?** Check whether you run go.opentelemetry.io/otel (Go), Opentelemetry Go SDK or Opentelemetry at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/otel (Go): upgrade to 1.41.0 or later

  ```sh
  go get go.opentelemetry.io/otel@v1.41.0
  ```


## Technical details

A resource exhaustion vulnerability (CWE-770/CWE-400) exists in OpenTelemetry-Go's baggage header extraction logic. The 'extractMultiBaggage' function in the propagation/baggage.go component independently parses each 'baggage' header field-value and aggregates them into a shared slice. While individual headers are subject to an 8192-byte limit, an attacker can bypass the intended resource constraints by sending a large number of header lines within the server's overall header limit (e.g., 1MB in default net/http). This results in excessive CPU cycles and memory allocations per request. The issue is fixed in version 1.41.0 by normalizing multi-values or enforcing a global budget.

## Affected products

- OpenTelemetry opentelemetry-go >= 1.36.0, < 1.41.0
- Red Hat multicluster engine for Kubernetes 2.11

## Identifiers

- CVE-2026-29181
- GHSA-mh2q-q3fh-2475
- GO-2026-5506

## Timeline

- 2026-04-07: disclosed
- 2026-04-07: advisory
- 2026-04-07: patched: Fixed in version 1.41.0

## References

- [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475)
- [https://access.redhat.com/errata/RHSA-2026:25271](https://access.redhat.com/errata/RHSA-2026:25271)
- [https://access.redhat.com/security/cve/CVE-2026-29181](https://access.redhat.com/security/cve/CVE-2026-29181)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2456252](https://bugzilla.redhat.com/show_bug.cgi?id=2456252)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json)

## Related threats

- [OpenTelemetry-Go Denial of Service via oversized baggage headers](https://junglewise.ai/threats/cve-2026-41178-opentelemetry-go-denial-of-service-via-oversized-baggage-headers)
- [OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path](https://junglewise.ai/threats/cve-2026-41078-opentelemetry-net-has-potential-memory-exhaustion-via-unbounded)
- [OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers](https://junglewise.ai/threats/cve-2026-40894-opentelemetry-dotnet-excessive-memory-allocation-when-parsing)
- [OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling](https://junglewise.ai/threats/cve-2026-40891-opentelemetry-dotnet-unbounded-grpc-status-details-bin-parsing-in)
- [OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies](https://junglewise.ai/threats/cve-2026-40182-opentelemetry-dotnet-otlp-exporter-reads-unbounded-http-response)