OpenTelemetry-Go's baggage parsing logic was altered in versions 1.41.0 and 1.43.0 to remove a maximum length check on raw header values. As a result, the Parse function can now process baggage headers of arbitrary size. This uncontrolled consumption of resources leads to application slowdown or crashes and is classified as a denial‑of‑service vulnerability under CWE‑789.

Impact hits the Go OpenTelemetry library, specifically the otel/baggage and otel/propagation packages. Versions 1.41.0 and 1.43.0 carry the flaw. The issue is resolved in subsequent releases, 1.42.0 and 1.44.0, so any deployments still using the affected versions are at risk.

The CVSS base score of 5.3 indicates a moderate likelihood of successful exploitation. No EPSS score is available, and the flaw is not in the CISA KEV list. Attackers could inject oversized baggage headers via HTTP requests or other propagation mechanisms that the library processes, causing the send‑receive stack to allocate excessive memory and generate repeated error logs. If the application has publicly exposed baggage headers, an external hostile client could repeatedly send such requests to exhaust resources.