Medium, CVSS 5.3GoPublished
opentelemetry-go's baggage parsing no longer caps raw header length
CVE-2026-41178 · GHSA-5wrp-cwcj-q835
- Affected
- Go go.opentelemetry.io/otel/baggage >= 1.41.0, <= 1.41.0; >= 1.43.0, <= 1.43.0
- Fixed in
- 1.44.01.42.0· Vendor fix available
- Issue
- https://github.com/open-telemetry/opentelemetry-go/pull/7880 removed raw-length rejection and it causes Parse to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Details The commit removes the upfront baggage-string length check and the per-member size guard in parsing. Parse now walks the entire input with strings.SplitSeq and skips invalid members while continuing to process the rest. For very large or malformed baggage headers, the parser still fully tokenizes and percent-decodes each member, and errors are forwarded to the global error handler (default logging). This lets a remote client send oversized/invalid headers to trigger excessive CPU/memory work and potentially large log output before any size limit is enforced, creating a denial-of-service risk in services that do not already enforce strict header size limits. Summary: - In baggage/baggage.go, parseMember performs full parsing and PathUnescape on the entire…
Recommended action: Upgrade to 1.44.0 or 1.42.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.