GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.34%
- Chance of exploitation in the next 30 days. Higher than 26.98% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-789 Memory Allocation with Excessive Size Value
- Fix
- Available
- 3 packages have a fixed version
Description
Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| go.opentelemetry.io/otel | >= 1.41.0, < 1.42.0>= 1.43.0, < 1.44.0 |
1.42.01.44.0 |
| go.opentelemetry.io/otel/baggage | 1 listed versions | No fix yet |
| go.opentelemetry.io/otel/baggage | 1 listed versions | No fix yet |
| go.opentelemetry.io/otel/baggage | >= 1.41.0, < 1.42.0 |
1.42.0 |
| go.opentelemetry.io/otel/baggage | >= 1.43.0, < 1.44.0 |
1.44.0 |
| go.opentelemetry.io/otel/propagation | 1 listed versions | No fix yet |
| go.opentelemetry.io/otel/propagation | 1 listed versions | No fix yet |
| go.opentelemetry.io/otel/propagation | >= 1.41.0, < 1.42.0 |
1.42.0 |
| go.opentelemetry.io/otel/propagation | >= 1.43.0, < 1.44.0 |
1.44.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
go.opentelemetry.io/otel Go → 1.44.0
- go
go get go.opentelemetry.io/otel@v1.44.0 && go mod tidy
go.opentelemetry.io/otel/baggage Go → 1.42.0
- go
go get go.opentelemetry.io/otel/baggage@v1.42.0 && go mod tidy
go.opentelemetry.io/otel/propagation Go → 1.42.0
- go
go get go.opentelemetry.io/otel/propagation@v1.42.0 && go mod tidy
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Weakness
CWE-789: Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
How to prevent it
- Implementation, Architecture and Design: Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
- Operation: Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
References
Advisories
Fixes and patches
Packages
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-mh2q-q3fh-2475 OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) | High | Also affects go.opentelemetry.io/otel |
| GHSA-q7v9-x93c-xqv3 zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction | High | Same weakness, CWE-789 |
| GHSA-9hj8-73fh-9963 zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size | High | Same weakness, CWE-789 |
| GHSA-j2w7-387v-m2rq PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS) | High | Same weakness, CWE-789 |
| GHSA-6wmf-3r64-vcwv Crass : Large numeric exponents cause CPU and memory denial of service | High | Same weakness, CWE-789 |
| GHSA-5xm2-6676-qcp9 Pillow: APNG background disposal allocates full canvas before decompression bomb check | High | Same weakness, CWE-789 |
| EEF-CVE-2026-97853 Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoS | Not rated yet | Same weakness, CWE-789 |
| GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated | Low | Same weakness, CWE-789 |
Credits: XSAM, pellared
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor