cveboard RSS feed

CVE-2026-45292

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

opentelemetry-java

Vendor
open-telemetry
Product
opentelemetry-java
Platforms
Unknown
Default status
Unknown
opentelemetry-java · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
< 1.62.0affectedUnavailableUnavailableUnavailableNone listed

opentelemetry-api

Vendor
io.opentelemetry
Product
opentelemetry-api
Platforms
Unknown
Default status
Unknown
opentelemetry-api · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.62.0affectedUnavailableUnavailableUnavailableNone listed

opentelemetry-extension-trace-propagators

Vendor
io.opentelemetry
Product
opentelemetry-extension-trace-propagators
Platforms
Unknown
Default status
Unknown
opentelemetry-extension-trace-propagators · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
1.62.0affectedUnavailableUnavailableUnavailableNone listed