7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29181

CVE-2026-29181: OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29181

CVE-2026-29181:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
go.opentelemetry.io/otel/baggage	go	>= 1.36.0, <= 1.40.0	1.41.0
go.opentelemetry.io/otel/propagation	go	>= 1.36.0, <= 1.40.0	1.41.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-mh2q-q3fh-2475, is a denial-of-service (DoS) weakness in OpenTelemetry-Go caused by excessive resource consumption when parsing W3C baggage headers. The root cause is the amplification of CPU and memory allocation when an HTTP request contains multiple baggage header fields.

The exploitation path begins at propagation.Baggage.Extract, the public entry point for baggage extraction. When multiple baggage headers are present, this function calls the internal propagation.extractMultiBaggage function. In its vulnerable state, extractMultiBaggage would iterate through every single baggage header value provided by the attacker. For each value, it would call baggage.Parse to process the string, and then aggregate the results. There was no mechanism to limit the total number of members collected across all headers, allowing the list of members to grow excessively.

This led to two primary points of resource exhaustion:

Repeated Parsing: The baggage.Parse function was called for each header, amplifying the CPU cost.
Excessive Allocation: After parsing, the baggage.New function was called with the aggregated list of all members. The vulnerable version of New would create a full string representation of all members in memory to check if it exceeded the size limit, leading to a massive memory allocation that could cause the application to slow down or crash.

The patch mitigates this by introducing checks early in the process. extractMultiBaggage now stops collecting members once the maximum limit (64) is reached. Furthermore, baggage.Parse and baggage.New were updated to incrementally validate limits and truncate data, preventing the large intermediate allocations that were the core of the DoS attack.

Vulnerable functions

go.opentelemetry.io/otel/propagation.Baggage.Extract

propagation/baggage.go

This is the public API entry point for extracting baggage from a carrier. It delegates to `extractMultiBaggage` when the carrier can have multiple values for the same header key. An exploit would trigger the vulnerability through this function.

go.opentelemetry.io/otel/propagation.extractMultiBaggage

propagation/baggage.go

This function is the core of the vulnerability. It iterates over all provided `baggage` header values, calls `baggage.Parse` for each one, and appends the results into a single slice. The vulnerable version lacked a limit on how many members it would collect, allowing an attacker to amplify resource consumption by sending many header values. The patch adds a `break` to exit the loop once the member limit is reached.

go.opentelemetry.io/otel/baggage.Parse

baggage/baggage.go

This function is called inside the loop of `extractMultiBaggage` and performs the expensive work of parsing the baggage string. The vulnerable version would parse an entire header value (up to 8192 bytes) on each call. When called repeatedly, this parsing work is amplified. The patch introduces incremental validation to stop parsing as soon as limits are breached, preventing excessive work on overly large inputs.

go.opentelemetry.io/otel/baggage.New

baggage/baggage.go

This function is called by `extractMultiBaggage` after collecting all members from all headers. The vulnerable version would construct a string representation of all collected members just to check the length, causing a very large allocation if the number of members was high. The patch changes this to truncate the member list to fit within size limits *before* any expensive string operations, mitigating the allocation amplification.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.