Unbounded memory use in OpenTelemetry Python Jaeger baggage parsing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
The opentelemetry-python package before 1.45.0, including the opentelemetry-propagator-jaeger PyPI package before 1.45.0, does not limit the uberctx-* baggage values that JaegerPropagator.extract() processes. An unauthenticated remote attacker who controls the propagated headers can send numerous or oversized values, which forces unnecessary CPU work and heap allocations that can cause a denial of service (CWE-770). The impact is greater with custom getters, non-HTTP transports or raised header limits, and it is reduced by common default Python HTTP server limits.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-python | before 1.45.0 | 1.45.0 | Patch available | CNA |
| — | opentelemetry-propagator-jaeger (PyPI) | before 1.45.0 | 1.45.0 | Patch available | GHSA-f5m9-jfrj-jjj7 |
- opentelemetry-python Vendoropen-telemetry Affected before 1.45.0 Fixed in 1.45.0 Patch available CNA
- opentelemetry-propagator-jaeger (PyPI) Vendor— Affected before 1.45.0 Fixed in 1.45.0 Patch available GHSA-f5m9-jfrj-jjj7
Remediation
Upgrade opentelemetry-python and opentelemetry-propagator-jaeger to version 1.45.0 or later, which fixes both packages.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA opentelemetry-python (open-telemetry) Fixed in 1.45.0
- Fix · GHSA-f5m9-jfrj-jjj7 opentelemetry-propagator-jaeger (PyPI) Fixed in 1.45.0 Advisory →
Vendor assessments
Timeline
- 2026-10-27 Threatist record created from CVE-2026-116694
- 2026-10-27 Alias added: GHSA-f5m9-jfrj-jjj7
- 2026-10-28 CISA SSVC decision points changed
- 2026-10-28 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-f5m9-jfrj-jjj7
- https://github.com/open-telemetry/opentelemetry-python/pull/5556
- https://github.com/open-telemetry/opentelemetry-python/commit/65c4eeb87cd3815dc795d3b5485e9ea0d5affcc7
- https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.0
- https://github.com/open-telemetry/opentelemetry-python
More open-telemetry vulnerabilities
- TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
- TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
- TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
- TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
- TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
- TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
Sources
- CVE-2026-116694 · CVE Program
- CVE-2026-116694 · NVD
- FIRST EPSS
- GHSA-f5m9-jfrj-jjj7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116694 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences