Read the docs
TI-2026-23298 Aliases CVE-2026-29181GHSA-mh2q-q3fh-2475

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Priority HIGH 72CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00821 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial opentelemetry-go (open-telemetry): 1.41.0go.opentelemetry.io/otel (Go): 1.41.0Red Hat: 12 advisoriesRed Hat: 10 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-go1.36.0 to before 1.41.01.41.0Patch availableCNA
—go.opentelemetry.io/otel (Go)1.36.0 to before 1.41.01.41.0Patch availableGHSA-mh2q-q3fh-2475
  • opentelemetry-go Vendoropen-telemetry Affected 1.36.0 to before 1.41.0 Fixed in 1.41.0 Patch available CNA
  • go.opentelemetry.io/otel (Go) Vendor— Affected 1.36.0 to before 1.41.0 Fixed in 1.41.0 Patch available GHSA-mh2q-q3fh-2475

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*1.36.0 to before 1.41.0Vulnerableopen-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:* Versions 1.36.0 to before 1.41.0 Vulnerable ·open-telemetry

Remediation

  • Fix · CNA opentelemetry-go (open-telemetry) Fixed in 1.41.0
  • Fix · GHSA-mh2q-q3fh-2475 go.opentelemetry.io/otel (Go) Fixed in 1.41.0 Advisory →

Red Hat 12 advisories

  • RHSA-2026:83013 Released 2026-10-14 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.0.17
    • Logging Subsystem for Red Hat OpenShift 6.0 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:82336 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.1
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 9 more Red Hat advisories
  • RHSA-2026:72475 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:72395 Released 2026-09-28 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.20.1
    • Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:70870 Released 2026-09-23 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.5.3
    • Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9 +3
  • RHSA-2026:68349 Released 2026-09-16 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.2.13
    • Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:66521 Released 2026-09-10 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.1
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/lokistack-gateway-rhel9 +1
  • RHSA-2026:63140 Released 2026-09-03 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.19.2
    • Cert Manager support for Red Hat OpenShift release 1.19 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:61314 Released 2026-08-31 · Red Hat rating Important
    Cluster Observability Operator 1.5.2
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
  • RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.8.9 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
  • RHSA-2026:25271 Released 2026-06-11 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.0 General Availability
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/console-mce-rhel9, registry.redhat.io/multicluster-engine/hypershift-addon-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Engine for KubernetesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 5AffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82322, RHSA-2026:82336
Cert Manager support for Red Hat OpenShift release 1.19Fixed RHSA-2026:63140
Cert Manager support for Red Hat OpenShift release 1.20Fixed RHSA-2026:72395, RHSA-2026:72475
Cluster Observability Operator 1.5Fixed RHSA-2026:61314
Logging Subsystem for Red Hat OpenShift 6.0Fixed RHSA-2026:83013
Logging Subsystem for Red Hat OpenShift 6.2Fixed RHSA-2026:68349
Logging Subsystem for Red Hat OpenShift 6.5Fixed RHSA-2026:70870
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:66521
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:25271
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:47735
Not affected: 10 products
  • Cluster Observability Operator 1.5
  • Logging Subsystem for Red Hat OpenShift 6.0
  • Logging Subsystem for Red Hat OpenShift 6.2
  • Logging Subsystem for Red Hat OpenShift 6.5
  • Logging Subsystem for Red Hat OpenShift 6.6
  • Multicluster Engine for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat OpenShift Container Platform 4
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-29181
  2. 2026-10-03 Alias added: GHSA-mh2q-q3fh-2475
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-07 Affected versions changed · Red Hat
  5. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  6. 2026-10-14 Fix available: RHSA-2026:82336 · Red Hat
  7. 2026-10-15 Fix available: RHSA-2026:83013 · Red Hat
  8. 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Logging Subsystem for Red Hat OpenShift 6.0 · Red Hat
  9. 2026-10-31 Affected versions changed · Red Hat
  10. 2026-11-04 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Exploit 1

Advisory 1

Other 4

  • TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
  • TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
  • TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-28762 Untrusted search path in open-telemetry opentelemetry-go CVSS 4.0HIGH 7.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences