Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-48504 EUVD-2026-45314GHSA-w9wp-h8wv-79jx

OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation

Published Jul 17, 2026 · Updated Jul 20, 2026 · Assigned by GitHub_M

Description

OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-rust < 0.32.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling deno 2.9.2-r0 —
Wolfi rolling linkerd2-proxy 2.362.0-r0 —
Wolfi rolling mountpoint-s3 1.22.3-r6 —
Wolfi rolling parseable 2.9.4-r0 —
Wolfi rolling wadm +2 No fix yet —
Wolfi rolling wasmcloud 2.5.2-r1 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io opentelemetry_sdk < 0.32.1 0.32.1 GHSA-w9wp-h8wv-79jx

References