5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45292

CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45292

CVE-2026-45292:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
io.opentelemetry:opentelemetry-api	maven	<= 1.61.0	1.62.0
io.opentelemetry:opentelemetry-extension-trace-propagators	maven	<= 1.61.0	1.62.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of input validation in the baggage propagation implementations within OpenTelemetry Java SDK. Specifically, the W3CBaggagePropagator, JaegerPropagator, and OtTracePropagator did not enforce any limits on the size or number of entries in the baggage headers they were parsing. This allowed a malicious actor to send a specially crafted, oversized baggage header, which would cause the application to consume an unbounded amount of memory and CPU resources during parsing, leading to a denial of service.

The extract methods of these propagators are the primary entry points for the vulnerability, as they are responsible for reading and parsing the baggage from incoming requests. The inject methods are also part of the vulnerability's impact, as they would propagate the oversized baggage to downstream services, causing the denial of service to cascade through a distributed system.

The fix, as seen in the provided commit, was to introduce and enforce limits on the maximum number of baggage entries and the maximum total byte size of the baggage, in line with the W3C Baggage specification recommendations. These checks were added to the extract and inject paths of all three affected propagators.

Vulnerable functions

io.opentelemetry.api.baggage.propagation.W3CBaggagePropagator.extract

api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java

The `extract` method in `W3CBaggagePropagator` is responsible for parsing baggage information from incoming requests. The vulnerable version of this function did not enforce any limits on the size of the baggage header, allowing an attacker to provide an oversized header that would cause the application to allocate a large amount of memory, potentially leading to a denial of service.

io.opentelemetry.api.baggage.propagation.W3CBaggagePropagator.inject

api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java

The `inject` method is responsible for adding baggage information to outgoing requests. If the service has processed a malicious oversized baggage header, the vulnerable `inject` method would then propagate this large baggage to any downstream services, causing the vulnerability to spread through the system.

io.opentelemetry.extension.trace.propagation.JaegerPropagator.extract

extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java

Similar to `W3CBaggagePropagator`, the `extract` method in `JaegerPropagator` was vulnerable to oversized baggage headers. It would parse Jaeger's baggage format without enforcing any limits, leading to the same unbounded memory allocation vulnerability.

io.opentelemetry.extension.trace.propagation.JaegerPropagator.inject

extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java

The `inject` method in `JaegerPropagator` was also vulnerable. After processing a malicious baggage header, this method would propagate the oversized baggage to downstream services using the Jaeger propagation format.

io.opentelemetry.extension.trace.propagation.OtTracePropagator.extract

extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java

The `extract` method in `OtTracePropagator` was also vulnerable to the same unbounded memory allocation issue. It parsed baggage from incoming requests using the OpenTracing format without any size or entry limits.

io.opentelemetry.extension.trace.propagation.OtTracePropagator.inject

extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java

The `inject` method in `OtTracePropagator` would propagate oversized baggage to downstream services, similar to the other propagators. This would cause the vulnerability to spread across services that use the OpenTracing propagation format.

io.opentelemetry.api.baggage.propagation.Parser.parseInto

api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java

This `parseInto` method is the low-level parser used by `W3CBaggagePropagator`. The vulnerability is rooted here for W3C baggage, as this function is responsible for the character-by-character parsing of the baggage header. The lack of limits in this function is the direct cause of the unbounded memory allocation when parsing W3C baggage.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.