OpenTelemetry Rust’s SDK allows inbound W3C Baggage headers larger than its internal limits to be parsed before size checks, an example of an unbounded memory allocation weakness (CWE‑770). This flaw existed in version 0.32.0 and earlier, where BaggagePropagator::extract_with_context did not enforce size limits before parsing an inbound baggage header, so a large attacker‑controlled header could cause unnecessary CPU work and short‑lived heap allocations. The SDK later discards entries that exceed its baggage limits, meaning all that extra work is wasted, potentially leading to increased per‑request CPU usage and transient memory pressure.

The vulnerability affects the OpenTelemetry Rust library, specifically the opentelemetry_sdk crate used by services that import OpenTelemetry for tracing. Any instance of opentelemetry-rust earlier than version 0.32.1 is susceptible. The issue was addressed by upgrading to version 0.32.1 or later, which introduces proper size checks before parsing the header.

The CVSS base score of 5.3 indicates moderate severity, and the EPSS score of less than 1 % suggests that exploitation is unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit it by sending a request with an oversized baggage header to any HTTP‑based service that forwards the header to the OpenTelemetry SDK. No special privileges are required; the vector is network‑based inbound traffic. If successful, an attacker may cause detectable CPU load spikes or temporary memory pressure, making the service more susceptible to resource exhaustion or Denial‑of‑Service attacks.