Parsing an oversized baggage header in opentelemetry-java's baggage propagation triggers an unbounded memory allocation and high CPU consumption. The library allocates memory proportional to the header size and consumes significant CPU resources. Because baggage is automatically re‑injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This flaw is fixed in version 1.62.0. The vulnerability is a CWE‑770 unbounded memory allocation issue.

The flaw exists in the opentelemetry-api, opentelemetry-extension-trace-propagators, and the open-telemetry opentelemetry-java packages for any release prior to version 1.62.0. Administrators should verify that the deployments of these components are at or above this version to eliminate the risk.

The vulnerability carries a CVSS score of 5.3, indicating a moderate severity. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, suggesting no confirmed exploit activity yet; however, because the flaw can be triggered by an inbound request with an overly long baggage header, the likely attack vector is via HTTP traffic to a service that propagates OpenTelemetry headers. Successful exploitation would bound system resources and could propagate the effect to downstream services that forward the malformed baggage.