What’s Vulnerable › Vulnerabilities

CVE-2026-41178: OpenTelemetry-Go's baggage parsing no longer caps raw header length

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-04 · updated 2026-07-22
• Weakness: CWE-789

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Affected products

• open-telemetry opentelemetry-go: before 1.42.0; 1.43.0 — fixed in 1.42.0

How to fix

Upgrade to a fixed version: open-telemetry opentelemetry-go 1.42.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-telemetry/opentelemetry-go/pull/7880
• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835

Get alerted when CVE-2026-41178 or the next vulnerability affects your stack