OpenTelemetry JavaScript's JaegerPropagator decodes incoming uber-trace-id and uberctx-* HTTP headers with decodeURIComponent() but does not handle decoding errors. When a malformed percent-encoded header is received, a URIError is thrown and propagates out of the propagator, causing the entire Node.js process to terminate. The result is a loss of availability for any service that relies on Jaeger propagation. The flaw is an unhandled exception, identified as CWE-248, and leads to a denial of service.

All Node.js applications that depend on the @opentelemetry/propagator-jaeger package before version 2.9.0 and have JaegerPropagator configured as the active propagator are affected. This includes any microservice or tracing agent that accepts inbound HTTP requests with Uber tracing headers. Versions older than 2.9.0, regardless of other OpenTelemetry components, remain vulnerable when JaegerPropagator is used. The issue is fixed starting with release v2.9.0 of opentelemetry-js; later versions are considered safe.

The CVSS base score of 7.5 indicates medium-high severity. The EPSS score of less than 1% suggests that the probability of exploitation is low, but a single crafted request can bring down a service due to the deterministic crash. The vulnerability can be exploited remotely by an unauthenticated attacker sending a malformed uber-trace-id or uberctx-* header to any HTTP endpoint that forwards traces with JaegerPropagator. The likely attack vector is a remote network request. The issue is not listed in the CISA KEV catalog, so no publicly known exploits are catalogued.