Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-116694 EUVD-2026-111385GHSA-f5m9-jfrj-jjj7

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

Published Oct 27, 2026 · Updated Oct 28, 2026 · Assigned by GitHub_M

Description

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-python < 1.45.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 python-opentelemetry 1.45.1-1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 python-opentelemetry No fix yet —
Ubuntu 26.04 LTS python-opentelemetry No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI opentelemetry-propagator-jaeger < 1.45.0 1.45.0 GHSA-f5m9-jfrj-jjj7

References