CVE-2026-41178

OpenTelemetry-Go's baggage parsing no longer caps raw header length

Published Jun 4, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Analysis

Technical impact

OpenTelemetry-Go's baggage parsing logic was altered in versions 1.41.0 and 1.43.0 to remove a maximum length check on raw header values. As a result, the Parse function can now process baggage headers of arbitrary size. This uncontrolled consumption of resources leads to application slowdown or crashes and is classified as a denial‑of‑service vulnerability under CWE‑789.

Affected Systems

Impact hits the Go OpenTelemetry library, specifically the otel/baggage and otel/propagation packages. Versions 1.41.0 and 1.43.0 carry the flaw. The issue is resolved in subsequent releases, 1.42.0 and 1.44.0, so any deployments still using the affected versions are at risk.

Risk and Exploitability

The CVSS base score of 5.3 indicates a moderate likelihood of successful exploitation. No EPSS score is available, and the flaw is not in the CISA KEV list. Attackers could inject oversized baggage headers via HTTP requests or other propagation mechanisms that the library processes, causing the send‑receive stack to allocate excessive memory and generate repeated error logs. If the application has publicly exposed baggage headers, an external hostile client could repeatedly send such requests to exhaust resources.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

open-telemetry

go.opentelemetry.io/otel/baggage

affected

Version	Status	Constraints
`= 1.41.0`	affected	—
`= 1.43.0`	affected	—

open-telemetry

go.opentelemetry.io/otel/propagation

affected

Version	Status	Constraints
`= 1.41.0`	affected	—
`= 1.43.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:opentelemetry:opentelemetry::::::go::*
	cpe:2.3:a:opentelemetry:opentelemetry:1.43.0:::::go::

No data.

Vendor Product Versions

Opentelemetry

Opentelemetry-go

Version	Status	Scheme	Platform
`1.41.0`	affected	semver	—
`1.43.0`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to OpenTelemetry-Go 1.42.0 or newer, which restores raw header length checks.
Configure maximum HTTP header size or enforce header length limits at the networking layer to prevent large baggage headers from reaching the application.
Enable logging throttling or disable detailed error logging for baggage parsing to curb log amplification during an attack.

Generated by OpenCVE AI on June 4, 2026 at 16:21 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-5wrp-cwcj-q835	opentelemetry-go's baggage parsing no longer caps raw header length

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.336% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/open-telemetry/opentelemetry-go/pull/7880
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835

History

Jun 5, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Opentelemetry Opentelemetry opentelemetry-go
Vendors & Products		Opentelemetry Opentelemetry opentelemetry-go

Jun 4, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 4, 2026 3:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Title		OpenTelemetry-Go's baggage parsing no longer caps raw header length
Weaknesses		CWE-789
References		https://github.com/open-telemetry/opentelemetry-go/pull/7880 https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`