CVE-2026-45292 — opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

Description (CNA)

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

Affected (CNA)

Vendor / product	Versions
open-telemetry / opentelemetry-java	affected < 1.62.0
io.opentelemetry / opentelemetry-api	affected 1.62.0
io.opentelemetry / opentelemetry-extension-trace-propagators	affected 1.62.0

CWE

CWE-770

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

redhat-SADP

A flaw was found in OpenTelemetry Java, specifically within the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators. A remote attacker can exploit this vulnerability by sending oversized baggage, which leads to unbounded memory allocation and high CPU consumption. This can result in a Denial of Service (DoS) for the affected service. Furthermore, because baggage is automatically re-injected into outgoing requests, the impact can spread to other downstream services.