Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

opentelemetry_sdk

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3crates.ioPublished

    opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

    CVE-2026-48504 · GHSA-w9wp-h8wv-79jx

    Affected
    • crates.io opentelemetry_sdk <= 0.32.0
    Fixed in
    0.32.1· Vendor fix available
    Issue
    BaggagePropagator::extractwithcontext in opentelemetrysdk did not enforce the W3C Baggage size limits before parsing an inbound baggage header. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits. The SDK now applies limits aligned with the W3C Baggage limits: - 64 list-members - 8192 bytes total Impact Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits. The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution. Patches Upgrade opentelemetrysdk to version 0.32.1 or later. Version 0.32.1 rejects baggage header…

    Recommended action: Upgrade to 0.32.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →