TI-2026-35864 Aliases CVE-2026-48504 GHSA-w9wp-h8wv-79jx

OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation

LOW 30CWE-770Published 2026-07-17 · Updated 2026-07-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00418 36th percentileScored 2026-11-07

Fix Fixed opentelemetry-rust (open-telemetry): 0.32.1opentelemetry_sdk (crates.io): 0.32.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-telemetry	opentelemetry-rust	before 0.32.1	0.32.1	Patch available	CNA
—	opentelemetry_sdk (crates.io)	before 0.32.1	0.32.1	Patch available	GHSA-w9wp-h8wv-79jx

opentelemetry-rust Vendoropen-telemetry Affected before 0.32.1 Fixed in 0.32.1 Patch available CNA
opentelemetry_sdk (crates.io) Vendor— Affected before 0.32.1 Fixed in 0.32.1 Patch available GHSA-w9wp-h8wv-79jx

Remediation

Fix · CNA opentelemetry-rust (open-telemetry) Fixed in 0.32.1
Fix · GHSA-w9wp-h8wv-79jx opentelemetry_sdk (crates.io) Fixed in 0.32.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-48504
2026-10-03 Alias added: GHSA-w9wp-h8wv-79jx

References

Other 3

TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5

See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences