EUVD-2026-19938
GHSA-mh2q-q3fh-2475
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend multiple baggage HTTP headers
-
ExploitParser processes each header value independently
-
ExecutionAggregate operations consume excessive CPU and memory
-
ImpactService availability degradation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions — remote unauthenticated exploitation against default installations of OpenTelemetry Go. Attacker sends multiple baggage: HTTP header lines to trigger CPU and memory amplification, bypassing per-value 8192-byte limits through header aggregation. |
| Impact | Real-world risk is HIGH for internet-facing services using OpenTelemetry Go with default baggage propagation enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects unauthenticated remote availability impact with low attack complexity. The vendor's proof-of-concept demonstrates concrete exploitability: 77x memory amplification (10.3MB vs 133KB baseline) and 7ms p95 latency degradation from just 80 header lines across 40 requests. Attack requirements are minimal - standard HTTP client libraries support multi-value headers, no authentication is required (PR:N), and exploitation is trivially automatable through simple header injection. No public exploit identified beyond vendor PoC at time of analysis, and not listed in CISA KEV (no confirmed active exploitation). However, the combination of trivial exploitation, vendor-confirmed reproducibility, and widespread OpenTelemetry adoption in cloud-native environments elevates practical risk. Services under load or with constrained resources face immediate availability impact. SSVC framework assessment: exploitation status is PoC-available, automatable is yes (simple HTTP flood), technical impact is partial (availability only), resulting in a priority remediation recommendation for production deployments. |
| Exploit ScenarioDerived | An unauthenticated remote attacker crafts HTTP requests containing 100+ baggage header lines, each approaching the 8192-byte individual parse limit with valid but repetitive baggage member syntax. These requests are sent to a public-facing API endpoint of a microservice using OpenTelemetry Go for distributed tracing. Each request triggers extractMultiBaggage to parse all header values independently, consuming 10+ MB of memory and 7+ ms of CPU time per request (77x baseline). By sending sustained traffic at moderate request rates (100 req/s), the attacker exhausts available memory and CPU resources, causing service degradation or complete unavailability for legitimate users. The attack requires only standard HTTP tooling, no authentication, and exploits semantically valid header usage, making it difficult to distinguish from legitimate high-cardinality tracing scenarios without deep packet inspection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 07, 2026
Resource exhaustion in OpenTelemetry Go propagation library (v1.41.0 and earlier) enables remote attackers to trigger severe CPU and memory amplification via crafted HTTP baggage headers. The vulnerability allows unauthenticated attackers to send multiple baggage header lines that bypass the 8192-byte per-value parse limit by triggering repeated parsing operations - achieving 77x memory amplification (10.3MB vs 133KB per request) in vendor-provided proof-of-concept testing. Vendor-released patch available in v1.41.0. EPSS data not available; no confirmed active exploitation (not in CISA KEV); publicly available exploit code exists (vendor-provided PoC demonstrating 77x amplification).
RemediationAI
Upgrade to OpenTelemetry Go v1.41.0 or later, which contains the fix in commit aa1894e09e3fe66860c7885cb40f98901b35277f per https://github.com/open-telemetry/opentelemetry-go/pull/7880. The patch enforces a global parsing budget across multi-value baggage headers by normalizing multiple header field-values into a single comma-joined string before parsing, ensuring that attacker-controlled header multiplicity cannot amplify resource consumption beyond the 8192-byte total limit. For applications unable to immediately upgrade, implement workarounds at the HTTP ingress layer: configure reverse proxies or API gateways to limit the number of baggage header lines per request (e.g., reject requests with more than 3-5 baggage headers) or enforce stricter total header size limits below the 1MB net/http default. Review server resource limits and monitoring to detect amplification attacks in progress. Vendor advisory and release notes available at https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenTelemetry Go's baggage propagation implementation (go.opentelemetry.io/otel/propagation) extracts W3C Baggage headers from HTTP requests to propagate distributed tracing context. The vulnerable code path in propagation/baggage.go:58 (extractMultiBaggage function) processes HTTP multi-value headers by iterating through each baggage header field independently, parsing each value through baggage.Parse and aggregating members across all values. While individual header values are subject to an 8192-byte parse limit, the function does not enforce a global budget across multiple header lines. This design flaw maps to CWE-400 (Uncontrolled Resource Consumption) - specifically an algorithmic complexity issue where attacker-controlled input multiplicity (number of header lines) directly multiplies computational work. Within net/http's default 1MB header size limit, an attacker can send approximately 120+ baggage header lines, each triggering full parse and allocation cycles, resulting in quadratic resource consumption relative to a single comma-joined header value that would be semantically equivalent per the W3C Baggage specification.
Know when Canonical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (https://github.com/open-telemetry/opentelemetry-go).
CVSS VectorVendor: https://github.com/open-telemetry/opentelemetry-go
Lifecycle Timeline
2DescriptionCVE.org
multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit.
severity
HIGH (availability / remote request amplification)
relevant links
- repository: https://github.com/open-telemetry/opentelemetry-go
- pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58
vulnerability details
pins: open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a as-of: 2026-02-04 policy: direct (no program scope provided)
callsite: propagation/baggage.go:58 (extractMultiBaggage) attacker control: inbound HTTP request headers (many baggage field-values) → propagation.HeaderCarrier.Values("baggage") → repeated baggage.Parse + member aggregation
root cause
extractMultiBaggage iterates over all baggage header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).
impact
in a default net/http configuration (max header bytes 1mb), a single request with many baggage: header field-values can cause large per-request allocations and increased latency.
example from the attached PoC harness (darwin/arm64; 80 values; 40 requests):
- canonical:
per_req_alloc_bytes=10315458andp95_ms=7 - control:
per_req_alloc_bytes=133429andp95_ms=0
proof of concept
canonical:
mkdir -p poc
unzip poc.zip -d poc
cd poc
make testoutput (excerpt):
[CALLSITE_HIT]: propagation/baggage.go:58 extractMultiBaggage
[PROOF_MARKER]: baggage_multi_value_amplification p95_ms=7 per_req_alloc_bytes=10315458 per_req_allocs=16165control:
cd poc
make controlcontrol output (excerpt):
[NC_MARKER]: baggage_single_value_baseline p95_ms=0 per_req_alloc_bytes=133429 per_req_allocs=480expected: multiple baggage header field-values should be semantically equivalent to a single comma-joined baggage value and should not multiply parsing/alloc work within the effective header byte budget. actual: multiple baggage header field-values trigger repeated parsing and member aggregation, causing high per-request allocations and increased latency even when each individual value is within 8192 bytes.
fix recommendation
avoid repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing. one mitigation approach is to treat multi-values as a single comma-joined string and cap total parsed bytes (for example 8192 bytes total).
fix accepted when: under the default PoC harness settings, canonical stays within 2x of control for per_req_alloc_bytes and per_req_allocs, and p95_ms stays below 2ms.
Executive ViewAI
OpenTelemetry Go propagation library versions 1.41.0 and earlier contain a resource exhaustion vulnerability that allows unauthenticated remote attackers to amplify memory consumption by up to 77x through crafted HTTP baggage headers, potentially causing denial of service across applications using affected library versions. This impacts all services leveraging OpenTelemetry instrumentation without patching, creating cluster-wide availability risk during exploitation.
Apply vendor patch. Interim mitigations pending patch deployment: implement HTTP request rate limiting on baggage header ingestion; configure WAF or load balancer rules to reject requests with excessive or malformed baggage headers; monitor CPU and memory utilization for anomalous resource consumption patterns on services processing baggage headers.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Containers 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Containers 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
Exploit-DB