Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

io.opentelemetry:opentelemetry-extension-trace-propagators

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3MavenPublished

    OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

    CVE-2026-45292 · GHSA-rcgg-9c38-7xpx

    Affected
    • Maven io.opentelemetry:opentelemetry-extension-trace-propagators <= 1.61.0
    Fixed in
    1.62.0· Vendor fix available
    Issue
    A vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. Technical Details - W3CBaggagePropagator did not enforce any limit on the total size or entry count of the baggage header. The parser iterated character-by-character through the entire value regardless of length. - JaegerPropagator and OtTracePropagator had the same gap in their respective baggage extraction paths. - The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; none of these limits were enforced. Impact The practical availability impact for most deployments is limited. Every major Java HTTP server enforces its own header size limit (Tomcat, Jetty, Netty,…

    Recommended action: Upgrade to 1.62.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →