Bug 2484830 (CVE-2026-41178) - CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers
Summary: CVE-2026-41178 github.com/open-telemetry/opentelemetry-go: go.opentelemetry.i...
Keywords:
Status: NEW
Alias: CVE-2026-41178
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2515044 2515045 2515046 2515047 2515049 2515051 2515052 2515053 2515054 2515055 2515058 2515062 2515063 2515065 2515068 2515070 2515071 2515072 2515073 2515074 2515076 2515077 2515078 2515079 2515080 2515081 2515082 2515083 2515084 2515085 2515086 2515087 2515088 2515090 2515092 2515093 2515094 2515095 2515096 2515097 2515100 2515101 2515102 2515104 2515105 2515106 2515107 2515108 2515110 2515111 2515115 2515116 2515117 2515118 2515120 2515121 2515123 2515124 2515125 2515126 2515127 2515128 2515129 2515130 2515132 2515135 2515138 2515139 2515142 2515143 2515145 2515048 2515050 2515057 2515059 2515060 2515061 2515064 2515066 2515067 2515069 2515075 2515089 2515091 2515098 2515099 2515103 2515109 2515112 2515113 2515114 2515119 2515122 2515131 2515133 2515134 2515136 2515137 2515140 2515144 2517703
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-04 16:01 UTC by OSIDB Bzimport
Modified: 2026-09-22 21:02 UTC (History)
125 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:65116 0 None None None 2026-09-08 08:02:30 UTC
Red Hat Product Errata RHSA-2026:65117 0 None None None 2026-09-08 10:06:22 UTC
Red Hat Product Errata RHSA-2026:65336 0 None None None 2026-09-08 11:15:16 UTC
Red Hat Product Errata RHSA-2026:66327 0 None None None 2026-09-10 05:33:55 UTC
Red Hat Product Errata RHSA-2026:66432 0 None None None 2026-09-10 15:01:40 UTC
Red Hat Product Errata RHSA-2026:67138 0 None None None 2026-09-14 13:34:02 UTC
Red Hat Product Errata RHSA-2026:67139 0 None None None 2026-09-14 13:41:25 UTC
Red Hat Product Errata RHSA-2026:67148 0 None None None 2026-09-14 13:32:26 UTC
Red Hat Product Errata RHSA-2026:67974 0 None None None 2026-09-16 12:21:48 UTC
Red Hat Product Errata RHSA-2026:67975 0 None None None 2026-09-16 12:36:02 UTC
Red Hat Product Errata RHSA-2026:68333 0 None None None 2026-09-16 17:16:39 UTC
Red Hat Product Errata RHSA-2026:68334 0 None None None 2026-09-16 17:21:09 UTC
Red Hat Product Errata RHSA-2026:68335 0 None None None 2026-09-16 17:19:13 UTC
Red Hat Product Errata RHSA-2026:68527 0 None None None 2026-09-17 06:33:24 UTC
Red Hat Product Errata RHSA-2026:68550 0 None None None 2026-09-22 09:00:30 UTC
Red Hat Product Errata RHSA-2026:69293 0 None None None 2026-09-21 17:02:43 UTC

Description OSIDB Bzimport 2026-06-04 16:01:33 UTC 
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Comment 2 errata-xmlrpc 2026-09-08 08:02:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65116 https://access.redhat.com/errata/RHSA-2026:65116
Comment 3 errata-xmlrpc 2026-09-08 10:06:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:65117 https://access.redhat.com/errata/RHSA-2026:65117
Comment 4 errata-xmlrpc 2026-09-08 11:15:11 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:65336 https://access.redhat.com/errata/RHSA-2026:65336
Comment 5 errata-xmlrpc 2026-09-10 05:33:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:66327 https://access.redhat.com/errata/RHSA-2026:66327
Comment 6 errata-xmlrpc 2026-09-10 15:01:35 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:66432 https://access.redhat.com/errata/RHSA-2026:66432
Comment 7 Jon Orris 2026-09-14 13:32:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:67148 https://access.redhat.com/errata/RHSA-2026:67148
Comment 8 Jon Orris 2026-09-14 13:33:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:67138 https://access.redhat.com/errata/RHSA-2026:67138
Comment 9 Jon Orris 2026-09-14 13:41:18 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:67139 https://access.redhat.com/errata/RHSA-2026:67139
Comment 10 Jon Orris 2026-09-16 12:21:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:67974 https://access.redhat.com/errata/RHSA-2026:67974
Comment 11 Jon Orris 2026-09-16 12:35:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:67975 https://access.redhat.com/errata/RHSA-2026:67975
Comment 12 Jon Orris 2026-09-16 17:16:33 UTC 
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:68333 https://access.redhat.com/errata/RHSA-2026:68333
Comment 13 Jon Orris 2026-09-16 17:19:06 UTC 
This issue has been addressed in the following products:

  RHEM 1.2 for RHEL 10
  RHEM 1.2 for RHEL 9

Via RHSA-2026:68335 https://access.redhat.com/errata/RHSA-2026:68335
Comment 14 Jon Orris 2026-09-16 17:21:02 UTC 
This issue has been addressed in the following products:

  RHEM 1.1 for RHEL 10
  RHEM 1.1 for RHEL 9

Via RHSA-2026:68334 https://access.redhat.com/errata/RHSA-2026:68334
Comment 15 Jon Orris 2026-09-17 06:33:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:68527 https://access.redhat.com/errata/RHSA-2026:68527
Comment 16 Jon Orris 2026-09-21 17:02:36 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:69293 https://access.redhat.com/errata/RHSA-2026:69293
Comment 17 Jon Orris 2026-09-22 09:00:24 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:68550 https://access.redhat.com/errata/RHSA-2026:68550
Note You need to log in before you can comment on or make changes to this bug.