Bug 2484830 (CVE-2026-41178) - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers
Summary: CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.i...
Keywords:
Status: NEW
Alias: CVE-2026-41178
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2515044 2515045 2515046 2515047 2515049 2515050 2515051 2515052 2515053 2515054 2515055 2515058 2515059 2515060 2515062 2515063 2515064 2515065 2515068 2515069 2515070 2515071 2515072 2515073 2515074 2515075 2515076 2515077 2515078 2515079 2515080 2515081 2515082 2515083 2515084 2515085 2515086 2515087 2515088 2515089 2515090 2515091 2515092 2515093 2515094 2515095 2515096 2515097 2515099 2515100 2515101 2515102 2515103 2515104 2515105 2515106 2515107 2515108 2515110 2515111 2515112 2515115 2515116 2515117 2515118 2515119 2515120 2515121 2515123 2515124 2515125 2515126 2515127 2515128 2515129 2515130 2515132 2515133 2515135 2515136 2515137 2515138 2515139 2515142 2515143 2515144 2515145 2515048 2515057 2515061 2515066 2515067 2515098 2515109 2515113 2515114 2515122 2515131 2515134 2515140 2517703
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-04 16:01 UTC by OSIDB Bzimport
Modified: 2026-08-20 22:19 UTC (History)
109 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-04 16:01:33 UTC 
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Note You need to log in before you can comment on or make changes to this bug.