Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

opentelemetry-propagator-jaeger

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.3PyPIAmendedPublished

    OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

    CVE-2026-116694 · GHSA-f5m9-jfrj-jjj7

    Affected
    • PyPI opentelemetry-propagator-jaeger < 1.45.0
    Fixed in
    1.45.0· Vendor fix available
    Issue
    `JaegerPropagator.extract()` in `opentelemetry-propagator-jaeger` did not enforce limits when extracting inbound `uberctx-*` baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept. Impact Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator: - Gunicorn allows a maximum of 100 request-header fields and 8,190 bytes per field by default. - Uvicorn’s h11…

    Recommended action: Upgrade to 1.45.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.com (1)osv.dev (2)Source checked Evidence →