opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
Priority LOW 26CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 5 fixed, 11 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01097 65th percentileScored 2026-11-07
Fix Partial opentelemetry-java (open-telemetry): 1.62.0io.opentelemetry:opentelemetry-api (Maven): 1.62.0+1 more productRed Hat: 6 advisoriesRed Hat: 5 fixed, 11 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-java | before 1.62.0 | 1.62.0 | Patch available | CNA |
| io.opentelemetry | opentelemetry-api | 1.62.0 | — | No fix listed | CNA |
| io.opentelemetry | opentelemetry-extension-trace-propagators | 1.62.0 | — | No fix listed | CNA |
| — | io.opentelemetry:opentelemetry-api (Maven) | before 1.62.0 | 1.62.0 | Patch available | GHSA-rcgg-9c38-7xpx |
| — | io.opentelemetry:opentelemetry-extension-trace-propagators (Maven) | before 1.62.0 | 1.62.0 | Patch available | GHSA-rcgg-9c38-7xpx |
- opentelemetry-java Vendoropen-telemetry Affected before 1.62.0 Fixed in 1.62.0 Patch available CNA
- opentelemetry-api Vendorio.opentelemetry Affected 1.62.0 Fixed in — No fix listed CNA
- opentelemetry-extension-trace-propagators Vendorio.opentelemetry Affected 1.62.0 Fixed in — No fix listed CNA
- io.opentelemetry:opentelemetry-api (Maven) Vendor— Affected before 1.62.0 Fixed in 1.62.0 Patch available GHSA-rcgg-9c38-7xpx
- io.opentelemetry:opentelemetry-extension-trace-propagators (Maven) Vendor— Affected before 1.62.0 Fixed in 1.62.0 Patch available GHSA-rcgg-9c38-7xpx
Remediation
- Fix · CNA opentelemetry-java (open-telemetry) Fixed in 1.62.0
- Fix · GHSA-rcgg-9c38-7xpx io.opentelemetry:opentelemetry-api (Maven) Fixed in 1.62.0 Advisory →
- Fix · GHSA-rcgg-9c38-7xpx io.opentelemetry:opentelemetry-extension-trace-propagators (Maven) Fixed in 1.62.0 Advisory →
Red Hat 6 advisories
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:60520 Released 2026-08-27 · Red Hat rating CriticalRHOAI 3.4.4 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
- RHSA-2026:43038 Released 2026-07-21 · Red Hat rating CriticalMigration Toolkit for Applications
- Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9
Show 3 more Red Hat advisories
- RHSA-2026:41951 Released 2026-07-20 · Red Hat rating ImportantRed Hat Data Grid 8.6.2 security update
- Red Hat Data Grid 8.6.2
- RHSA-2026:36820 Released 2026-07-08 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.29.0 Release.
- Red Hat OpenShift Dev Spaces 3.29 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/multicluster-redirector-rhel9 +6
- RHSA-2026:28573 Released 2026-06-23 · Red Hat rating ImportantRed Hat Offline Knowledge Portal security and content update
- Red Hat Offline Knowledge Portal 1.2.13 registry.redhat.io/offline-knowledge-portal/rhokp-rhel9
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Exploit Intelligence | Affected | No fix yet |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat Build of Keycloak | Affected | No fix yet |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | — |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet |
| Red Hat build of Debezium 3 | Affected | No fix yet |
| Red Hat build of Quarkus | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8.6.2 | Fixed | RHSA-2026:41951 |
| Red Hat Migration Toolkit for Applications 8.2 | Fixed | RHSA-2026:43038 |
| Red Hat Offline Knowledge Portal 1.2.13 | Fixed | RHSA-2026:28573 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:60520, RHSA-2026:84734 |
| Red Hat OpenShift Dev Spaces 3.29 | Fixed | RHSA-2026:36820 |
Not affected: 14 products
- Migration Toolkit for Containers
- OpenShift Lightspeed
- Red Hat 3scale API Management Platform 2
- Red Hat AI Inference Server
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Migration Toolkit for Applications 8.2
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Dev Spaces 3.29
- Red Hat Quay 3
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2026-45292
- 2026-10-03 Alias added: GHSA-rcgg-9c38-7xpx
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Affected versions changed · Red Hat
References
Other 5
- https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx
- https://github.com/open-telemetry/opentelemetry-java/pull/8380
- https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f
- https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0
- https://github.com/open-telemetry/opentelemetry-java
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2026-45292 · CVE Program
- CVE-2026-45292 · NVD
- FIRST EPSS
- GHSA-rcgg-9c38-7xpx · GitHub Advisory Database · CC BY 4.0
- CVE-2026-45292 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences