Executive brief
OpenTelemetry Java SDK is a tool used by developers to monitor and trace application performance. A vulnerability in how it handles 'baggage' headers allows an attacker to send specially crafted, oversized data that causes the application to consume excessive memory and CPU. This can lead to service slowdowns or crashes, and because these headers are automatically passed to other internal services, a single malicious request can impact an entire network of applications.
Technical details
The vulnerability exists in the W3CBaggagePropagator, JaegerPropagator, and OtTracePropagator components of the OpenTelemetry Java SDK. These propagators failed to enforce limits on the total size or entry count of 'baggage' headers, iterating character-by-character through the entire value regardless of length. An unauthenticated remote attacker can exploit this by sending a request with an oversized baggage header, leading to CWE-770 (Allocation of Resources Without Limits or Throttling). While many Java HTTP servers (like Tomcat or Jetty) mitigate this by enforcing default 8 KiB header limits, the risk remains high in environments with custom transports or absent transport-layer limits. The issue is fixed in version 1.62.0, which enforces a maximum baggage size of 8,192 bytes and 64 entries.
Affected products
- OpenTelemetry opentelemetry-api <= 1.61.0
- OpenTelemetry opentelemetry-extension-trace-propagators <= 1.61.0
Timeline
- 2026-05-08: disclosed: Initial disclosure by reporter August829
- 2026-05-14: advisory: GitHub Advisory published
- 2026-05-28: other: NVD publication date