Skip to content
OpenAdvisories
High · 7.5 CVE-2026-29181 EUVD-2026-19938GHSA-mh2q-q3fh-2475GO-2026-5506

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Published Apr 7, 2026 · Updated Sep 17, 2026 · Assigned by GitHub_M

Vendor: open-telemetry Product: opentelemetry-go Package: aactl Package: act Package: amazon-cloudwatch-agent-operator Package: argo-events Package: argo-rollouts Package: argocd-image-updater Package: aws-efs-csi-driver Package: aws-privateca-issuer Package: azl-otel-collector Package: azurelinux-image-tools Package: buildah Package: buildah Package: cadvisor Package: cert-manager-cmctl Package: chartmuseum Package: cilium-1.19 Package: cilium-1.19-clustermesh-apiserver Package: cilium-1.19-hubble-relay Package: cilium-1.19-operator-aws Package: cilium-1.19-operator-generic Package: cilium-cli Package: cloud-provider-aws-1.31-cloud-controller-manager Package: cloud-provider-vsphere Package: cloudflared Package: cluster-api-ipam-provider-in-cluster Package: cluster-api-provider-vsphere Package: consul-k8s-1.9 Package: consul-k8s-1.9-cli Package: coredns-1.13 Package: cri-tools Package: crictl Package: crossplane-provider-aws-cloudformation Package: crossplane-provider-aws-cloudfront Package: crossplane-provider-aws-cloudwatchlogs Package: crossplane-provider-aws-dynamodb Package: crossplane-provider-aws-ec2 Package: crossplane-provider-aws-eks Package: crossplane-provider-aws-elasticache Package: crossplane-provider-aws-firehose Package: crossplane-provider-aws-iam Package: crossplane-provider-aws-kinesis Package: crossplane-provider-aws-kms Package: crossplane-provider-aws-lambda Package: crossplane-provider-aws-memorydb Package: crossplane-provider-aws-rds Package: crossplane-provider-aws-route53 Package: crossplane-provider-aws-s3 Package: crossplane-provider-aws-sns Package: crossplane-provider-aws-sqs Package: crossplane-provider-azure-authorization Package: crossplane-provider-azure-managedidentity Package: crossplane-provider-azure-sql Package: crossplane-provider-azure-storage Package: crossplane-provider-family-azure Package: crossplane-provider-sql Package: datadog-agent-7.77 Package: datadog-agent-7.77-full Package: datadog-cluster-agent-7.77 Package: dataplaneapi Package: db-operator Package: dex Package: docker-machine-driver-harvester Package: dogstatsd-7.77 Package: eksctl Package: emissary Package: emissary-apiext Package: envoy-ratelimit Package: etcd Package: external-secrets-operator-1.1 Package: external-secrets-operator-2.3 Package: external-secrets-operator-2.4 Package: falco-no-driver Package: flux-2.7 Package: flux-2.8 Package: flux-helm-controller Package: flux-image-automation-controller Package: flux-image-reflector-controller Package: gatus Package: gitaly-18.6 Package: gitaly-18.7 Package: gitaly-18.8 Package: gitaly-backup-18.6 Package: gitaly-backup-18.7 Package: gitaly-backup-18.8 Package: gitlab-agent-18.6 Package: gitlab-agent-18.7 Package: gitlab-agent-18.8 Package: gitlab-agent-18.9 Package: gitlab-docker-machine-18.10 Package: gitlab-docker-machine-18.11 Package: gitlab-docker-machine-18.7 Package: gitlab-docker-machine-18.8 Package: gitlab-docker-machine-18.9 Package: gitlab-kas-18.6 Package: gitlab-kas-18.7 Package: gitlab-kas-18.8 Package: gitlab-kas-18.9 Package: gitlab-pages-18.10 Package: gitlab-pages-18.8 Package: gitlab-pages-18.9 Package: go-discover Package: go.opentelemetry.io/otel Package: golang-opentelemetry-otel Package: grafana-agent-operator Package: haproxy-ingress-0.16 Package: hubble Package: ignition-flatcar Package: ingress-nginx-controller-1.12 Package: ipfs-cluster Package: k3d Package: k3d-tools Package: k8ssandra-client Package: kapp Package: kargo Package: kata-containers-preview Package: knative-client Package: ko Package: kserve-modelmesh-serving Package: kserve-qpext Package: kubectl-1.32 Package: kubectl-argo-rollouts Package: kuberay-operator Package: kubernetes-csi-driver-hostpath Package: kubernetes-csi-driver-nfs Package: kubernetes-csi-livenessprobe Package: kubernetes-csi-node-driver-registrar-2.16 Package: kubernetes-event-exporter Package: litestream Package: mesosphere-vsphere-csi-driver Package: metallb Package: metallb-controller Package: metallb-frr Package: metallb-frr-compat Package: metallb-speaker Package: nerdctl Package: net-kourier-1.21 Package: neuvector-scanner Package: neuvector-scanner-task Package: node-problem-detector-1.35 Package: nuclei Package: opentofu-1.9 Package: osv-scanner Package: podman Package: podman Package: prometheus-3.10 Package: prometheus-3.8 Package: prometheus-3.9 Package: promxy Package: rancher-machine Package: rancher-webhook-0.10 Package: rclone Package: rpk-26.1.2 Package: skopeo Package: slsa-verifier Package: spark-operator Package: src Package: step Package: step-ca Package: step-issuer Package: terraform Package: tetra Package: tetragon Package: trivy Package: undock Package: vault-env Package: vertical-pod-autoscaler Package: vertical-pod-autoscaler-recommender Package: vertical-pod-autoscaler-updater Package: vexctl Package: yunikorn-k8shim Ecosystem: Azure Linux Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-go >= 1.36.0, < 1.41.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-opentelemetry-otel No fix yet —
Ubuntu 26.04 LTS golang-opentelemetry-otel No fix yet —
Ubuntu 25.10 golang-opentelemetry-otel No fix yet —
Ubuntu 24.04 LTS golang-opentelemetry-otel No fix yet —
Ubuntu 22.04 LTS golang-opentelemetry-otel No fix yet —
ReleasePackageFixed inAdvisory
SLES 15 SP7 containerized-data-importer 1.64.0-150700.9.11.1 SUSE-SU-2026:2493-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1
SLES 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 SUSE-SU-2026:23227-1, SUSE-SU-2026:23216-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed etcd 3.6.13-1.1 openSUSE-SU-2026:11173-1
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260727T201416-160000.1.1 openSUSE-SU-2026:21551-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 azurelinux-image-tools 1.3.0-1 —
Azure Linux 3 etcd 3.5.30-2 —
Azure Linux 3 ignition-flatcar 2.22.0-5 —
Azure Linux 3 podman +3 No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling aactl 0.4.12-r49 —
Wolfi rolling act 0.2.87-r4 —
Wolfi rolling amazon-cloudwatch-agent-operator 3.4.1-r1 —
Wolfi rolling argo-events 1.9.10-r17 —
Wolfi rolling argo-rollouts +1 1.9.0-r9 —
Wolfi rolling argocd-image-updater 1.1.1-r9 —
Wolfi rolling aws-efs-csi-driver 3.0.1-r1 —
Wolfi rolling aws-privateca-issuer 1.8.1-r2 —
Wolfi rolling buildah 1.43.1-r2 —
Wolfi rolling cadvisor 0.56.2-r16 —
Wolfi rolling cert-manager-cmctl 2.4.1-r7 —
Wolfi rolling chartmuseum 0.16.5-r5 —
Wolfi rolling cilium-1.19 +4 1.19.3-r3 —
Wolfi rolling cilium-cli 0.19.2-r9 —
Wolfi rolling cloudflared 2026.5.0-r1 —
Wolfi rolling cluster-api-ipam-provider-in-cluster 1.1.0-r4 —
Wolfi rolling cluster-api-provider-vsphere 1.15.2-r11 —
Wolfi rolling consul-k8s-1.9 +1 1.9.6-r5 —
Wolfi rolling crictl +2 1.36.0-r0 —
Wolfi rolling crossplane-provider-aws-s3 +17 2.5.0-r6 —
Wolfi rolling crossplane-provider-azure-authorization +1 2.5.0-r9 —
Wolfi rolling crossplane-provider-azure-sql +1 2.5.0-r8 —
Wolfi rolling crossplane-provider-family-azure 2.5.0-r7 —
Wolfi rolling crossplane-provider-sql 0.14.0-r6 —
Wolfi rolling dataplaneapi 3.3.3-r1 —
Wolfi rolling db-operator 2.16.0-r10 —
Wolfi rolling dex 2.45.1-r8 —
Wolfi rolling docker-machine-driver-harvester 1.0.6-r8 —
Wolfi rolling dogstatsd-7.77 +3 7.77.3-r4 —
Wolfi rolling eksctl 0.225.0-r6 —
Wolfi rolling emissary +1 3.10.0-r30 —
Wolfi rolling envoy-ratelimit 0.0.0_git20260419-r1 —
Wolfi rolling external-secrets-operator-2.3 2.3.0-r4 —
Wolfi rolling external-secrets-operator-2.4 2.4.0-r2 —
Wolfi rolling falco-no-driver 0.44.0-r0 —
Wolfi rolling flux-2.7 2.7.5-r16 —
Wolfi rolling flux-2.8 2.8.6-r2 —
Wolfi rolling flux-helm-controller 1.5.4-r1 —
Wolfi rolling flux-image-automation-controller 1.1.2-r1 —
Wolfi rolling flux-image-reflector-controller 1.1.1-r5 —
Wolfi rolling gatus 5.35.0-r9 —
Wolfi rolling gitaly-18.6 +20 No fix yet —
Wolfi rolling gitlab-docker-machine-18.10 18.10.1-r4 —
Wolfi rolling gitlab-docker-machine-18.11 18.11.2-r1 —
Wolfi rolling gitlab-docker-machine-18.9 18.9.0-r9 —
Wolfi rolling gitlab-kas-18.9 +1 18.9.6-r2 —
Wolfi rolling gitlab-pages-18.10 18.10.5-r1 —
Wolfi rolling gitlab-pages-18.9 18.9.6-r1 —
Wolfi rolling go-discover 0_git20260413-r1 —
Wolfi rolling grafana-agent-operator 0.44.8-r4 —
Wolfi rolling haproxy-ingress-0.16 0.16.0-r3 —
Wolfi rolling hubble 1.19.3-r1 —
Wolfi rolling ipfs-cluster 1.1.5-r13 —
Wolfi rolling k3d +1 5.8.3-r32 —
Wolfi rolling k8ssandra-client 0.8.10-r11 —
Wolfi rolling kapp 0.65.2-r0 —
Wolfi rolling kargo 1.9.6-r1 —
Wolfi rolling knative-client 1.21.0-r9 —
Wolfi rolling ko 0.18.1-r11 —
Wolfi rolling kserve-modelmesh-serving 0.12.0-r28 —
Wolfi rolling kserve-qpext 0.18.0-r1 —
Wolfi rolling kuberay-operator 1.6.1-r1 —
Wolfi rolling kubernetes-csi-driver-hostpath 1.17.1-r11 —
Wolfi rolling kubernetes-csi-driver-nfs 4.13.2-r2 —
Wolfi rolling kubernetes-csi-livenessprobe 2.18.0-r6 —
Wolfi rolling kubernetes-csi-node-driver-registrar-2.16 2.16.0-r12 —
Wolfi rolling kubernetes-event-exporter 1.7-r57 —
Wolfi rolling litestream 0.5.12-r2 —
Wolfi rolling mesosphere-vsphere-csi-driver 3.5.0-r16 —
Wolfi rolling metallb +4 0.16.0-r2 —
Wolfi rolling nerdctl 2.2.2-r3 —
Wolfi rolling net-kourier-1.21 1.21.0-r8 —
Wolfi rolling neuvector-scanner +1 4.139-r1 —
Wolfi rolling node-problem-detector-1.35 1.35.2-r11 —
Wolfi rolling nuclei 3.8.0-r3 —
Wolfi rolling opentofu-1.9 1.9.4-r14 —
Wolfi rolling osv-scanner 2.3.6-r1 —
Wolfi rolling podman 5.8.2-r1 —
Wolfi rolling prometheus-3.10 3.10.0-r7 —
Wolfi rolling prometheus-3.9 3.9.1-r7 —
Wolfi rolling promxy 0.0.93-r15 —
Wolfi rolling rancher-machine 0.15.0.142-r4 —
Wolfi rolling rancher-webhook-0.10 0.10.0-r3 —
Wolfi rolling rclone 1.73.5-r2 —
Wolfi rolling rpk-26.1.2 26.1.2-r2 —
Wolfi rolling skopeo 1.22.2-r1 —
Wolfi rolling slsa-verifier 2.7.1-r16 —
Wolfi rolling spark-operator 2.5.1-r1 —
Wolfi rolling src 7.1.0-r2 —
Wolfi rolling step 0.30.2-r5 —
Wolfi rolling step-ca 0.30.2-r6 —
Wolfi rolling step-issuer 0.10.2-r8 —
Wolfi rolling terraform 1.5.7-r47 —
Wolfi rolling tetra +1 1.6.0-r8 —
Wolfi rolling trivy 0.69.3-r11 —
Wolfi rolling undock 0.12.0-r1 —
Wolfi rolling vault-env 1.22.1-r11 —
Wolfi rolling vertical-pod-autoscaler +2 1.6.0-r7 —
Wolfi rolling vexctl 0.4.1-r18 —
Wolfi rolling yunikorn-k8shim 1.8.0-r13 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go go.opentelemetry.io/otel >= 1.36.0, < 1.41.0 1.41.0 GHSA-mh2q-q3fh-2475

Advisories 7

References