Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

go.opentelemetry.io/otel

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5GoPublished

    OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)

    CVE-2026-29181 · GHSA-mh2q-q3fh-2475

    Affected
    • Go go.opentelemetry.io/otel >= 1.36.0, <= 1.40.0
    Fixed in
    1.41.0· Vendor fix available
    Issue
    multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. severity HIGH (availability / remote request amplification) relevant links - repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58 vulnerability details pins: open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a as-of: 2026-02-04 policy: direct (no program scope provided) callsite: propagation/baggage.go:58 (extractMultiBaggage) attacker control: inbound HTTP request headers (many baggage field-values) → propagation.HeaderCarrier.Values("baggage") → repeated baggage.Parse + member aggregation root cause extractMultiBaggage…

    Recommended action: Upgrade to 1.41.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →