CVE-2026-29181highCWE-770

CVE-2026-29181: falha de alta gravidade em open-telemetry opentelemetry-go

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar opentelemetry-go+ Monitorar go.opentelemetry.io/otel

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.8%
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
open-telemetry · opentelemetry-go
CVEs relacionadas — open-telemetry opentelemetry-go

No mesmo produto, das mais perigosas para as menos.

CVE-2026-81872MEDIUMOpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullEPSS 0.4%CVE-2026-81870LOWOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsEPSS 0.3%CVE-2026-39883HIGHOpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijackingEPSS 0.3%CVE-2026-39882MEDIUMOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesEPSS 0.2%CVE-2026-81871MEDIUMOpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningEPSS 0.2%CVE-2026-81869MEDIUMOpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationEPSS 0.2%