OpenTelemetry Python EUVD-2026-111385

Requires the optional opentelemetry-propagator-jaeger package to be installed AND the Jaeger propagator to be explicitly enabled - it is not part of the default OpenTelemetry Python configuration - and the service must accept untrusted inbound propagation (uberctx-*) headers. Exploitation is practically limited by transport-level header constraints: Gunicorn's default 100 header fields and 8,190 bytes per field, and Uvicorn/h11's default 16,384-byte buffer, blunt the attack. Exposure is materially higher for non-HTTP transports, custom TextMapGetter implementations, or deployments where server/gateway header limits have been raised or disabled. Impact is confined to availability; no authentication is required per the CVSS vector (PR:N), but the deployment preconditions (AT:P) are the real gate.

This is a medium-severity availability-only issue (CWE-770, unbounded resource consumption) whose real-world priority is modest. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 with impact limited to VA:L and zero confidentiality or integrity effect; notably AT:P flags that a specific attack requirement exists - namely that the optional Jaeger propagator be installed and enabled and that transport-level header limits be absent or raised. No EPSS score and no CISA KEV listing were provided, and no KEV or POC flag is set, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-available, low-impact DoS rather than an urgent threat. The chief tension in the data is between the network-reachable, unauthenticated CVSS vector and the vendor's own statement that practical impact is limited: the opentelemetry-propagator-jaeger package must be installed separately, is not enabled by default, and common Python servers (Gunicorn: 100 header fields / 8,190 bytes each; Uvicorn/h11: 16,384-byte buffer) already constrain the input before it reaches the propagator. Net: a genuine but low-urgency, deployment-conditional availability bug - patch during routine maintenance rather than treat as a drop-everything priority.

An attacker sends HTTP requests carrying numerous or oversized uberctx-* baggage headers to a service that has enabled the optional Jaeger propagator and accepts untrusted inbound propagation headers. JaegerPropagator.extract() processes every value with no per-entry, per-byte, or total-byte cap, forcing unnecessary CPU work and short-lived heap allocations per request; sustained requests contribute to denial of service where transport-level header limits are absent or raised. No public exploit code is identified; exploitation is most viable over non-HTTP transports, with custom TextMapGetter implementations, or where server/gateway header limits have been increased or disabled.