← Back

CVE-2026-41178

nvd nist
Published: Jun 4, 2026Modified: Jul 22, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability: 3.9 / Impact: 1.4
Source: security-advisories@github.com (Secondary)

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Affected (2)

Opentelemetry
1 product
Opentelemetry
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Opentelemetry
Opentelemetry
Before 1.42.0
Opentelemetry
Version 1.43.0

Related CWEs

CWE-789
Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (3)

Source: security-advisories@github.com
Issue TrackingPatch
Source: security-advisories@github.com
Issue TrackingPatchVendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Issue TrackingPatchVendor Advisory

Timeline

No history available yet.