CVE-2026-45292: OpenTelemetry Java unbounded memory allocation in baggage propagation

CVE-2026-45292 · Severity: medium · CVSS 5.3 · Published 2026-05-28

OpenTelemetry Java SDK is a tool used by developers to monitor and trace application performance. A vulnerability in how it handles 'baggage' headers allows an attacker to send specially crafted, oversized data that causes the application to consume excessive memory and CPU. This can lead to service slowdowns or crashes, and because these headers are automatically passed to other internal services, a single malicious request can impact an entire network of applications.

Vendors: Maven, Opentelemetry.

Quick answers

Is CVE-2026-45292 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45292 being exploited in the wild.
How severe is CVE-2026-45292?
Medium severity, with a CVSS score of 5.3, published 28 May 2026.
Which products and versions are affected?
io.opentelemetry:opentelemetry-api (Maven) <= 1.61.0, ECOSYSTEM:introduced=0,fixed=1.62.0; io.opentelemetry:opentelemetry-extension-trace-propagators (Maven) <= 1.61.0, ECOSYSTEM:introduced=0,fixed=1.62.0; Opentelemetry-Extension-Trace-Propagators <= 1.61.0.
Is there a fix for CVE-2026-45292?
Yes. io.opentelemetry:opentelemetry-api (Maven): upgrade to 1.62.0 or later; io.opentelemetry:opentelemetry-extension-trace-propagators (Maven): upgrade to 1.62.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45292 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45292?
Check whether you run io.opentelemetry:opentelemetry-api (Maven), io.opentelemetry:opentelemetry-extension-trace-propagators (Maven) or Opentelemetry-Extension-Trace-Propagators at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.opentelemetry:opentelemetry-api (Maven): upgrade to 1.62.0 or later
    # set io.opentelemetry:opentelemetry-api to 1.62.0 in your pom.xml or build.gradle
  • io.opentelemetry:opentelemetry-extension-trace-propagators (Maven): upgrade to 1.62.0 or later
    # set io.opentelemetry:opentelemetry-extension-trace-propagators to 1.62.0 in your pom.xml or build.gradle

Technical details

The vulnerability exists in the W3CBaggagePropagator, JaegerPropagator, and OtTracePropagator components of the OpenTelemetry Java SDK. These propagators failed to enforce limits on the total size or entry count of 'baggage' headers, iterating character-by-character through the entire value regardless of length. An unauthenticated remote attacker can exploit this by sending a request with an oversized baggage header, leading to CWE-770 (Allocation of Resources Without Limits or Throttling). While many Java HTTP servers (like Tomcat or Jetty) mitigate this by enforcing default 8 KiB header limits, the risk remains high in environments with custom transports or absent transport-layer limits. The issue is fixed in version 1.62.0, which enforces a maximum baggage size of 8,192 bytes and 64 entries.

Affected products

  • OpenTelemetry opentelemetry-api <= 1.61.0
  • OpenTelemetry opentelemetry-extension-trace-propagators <= 1.61.0

Identifiers

  • CVE-2026-45292
  • GHSA-rcgg-9c38-7xpx

Timeline

  • 2026-05-08: disclosed: Initial disclosure by reporter August829
  • 2026-05-14: advisory: GitHub Advisory published
  • 2026-05-28: other: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.