Read the docs
TI-2026-42706 Aliases CVE-2026-59892GHSA-45rx-2jwx-cxfr

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Priority HIGH 72CWE-248Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00557 46th percentileScored 2026-11-07
Fix Partial opentelemetry-js (open-telemetry): 2.9.0@opentelemetry/propagator-jaeger (npm): 2.9.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-jsbefore 2.9.02.9.0Patch availableCNA
—@opentelemetry/propagator-jaeger (npm)before 2.9.02.9.0Patch availableGHSA-45rx-2jwx-cxfr
  • opentelemetry-js Vendoropen-telemetry Affected before 2.9.0 Fixed in 2.9.0 Patch available CNA
  • @opentelemetry/propagator-jaeger (npm) Vendor— Affected before 2.9.0 Fixed in 2.9.0 Patch available GHSA-45rx-2jwx-cxfr

Remediation

  • Fix · CNA opentelemetry-js (open-telemetry) Fixed in 2.9.0
  • Fix · GHSA-45rx-2jwx-cxfr @opentelemetry/propagator-jaeger (npm) Fixed in 2.9.0 Advisory →

Red Hat 2 advisories

  • RHSA-2026:52768 Released 2026-08-10 · Red Hat rating Important
    Red Hat Developer Hub 1.9.8 release.
    • Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9
  • RHSA-2026:49642 Released 2026-08-03 · Red Hat rating Important
    Red Hat Developer Hub 1.10.3 release.
    • Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Self-service automation portal 2AffectedNo fix yet
Red Hat Developer Hub 1.10Fixed RHSA-2026:49642
Red Hat Developer Hub 1.9Fixed RHSA-2026:52768
Not affected: 3 products
  • OpenShift Serverless
  • Red Hat Developer Hub 1.10
  • Red Hat Developer Hub 1.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59892
  2. 2026-10-03 Alias added: GHSA-45rx-2jwx-cxfr
  3. 2026-10-26 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 4

  • TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
  • TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
  • TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
  • TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
  • TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
  • TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences