Executive brief
OpenTelemetry Rust is a library used by developers to monitor and trace the performance of their applications. A vulnerability in how it handles 'baggage' headers—metadata passed between services—allows an attacker to send specially crafted, oversized headers that force the system to perform excessive processing and memory allocation. This can lead to increased resource consumption and potential service slowdowns or outages (Denial of Service).
Technical details
A resource exhaustion vulnerability exists in the `BaggagePropagator::extract_with_context` function of the `opentelemetry_sdk` crate. The implementation fails to enforce W3C Baggage size limits (8192 bytes and 64 list-members) before parsing inbound headers. An attacker can provide a large, untrusted baggage header that triggers repeated string splitting, percent-decoding, and heap allocations for entries that are ultimately discarded by the SDK's internal storage limits. This can be exploited over the network without authentication to cause a localized Denial of Service (DoS). The issue is resolved in version 0.32.1 by rejecting headers exceeding 8192 bytes and truncating list-members to 64.
Affected products
- open-telemetry opentelemetry-rust <= 0.32.0
- open-telemetry opentelemetry_sdk <= 0.32.0
Timeline
- 2026-05-22: patched: Fix committed to repository
- 2026-05-26: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE published to NVD