Vulnerability · Published Jun 4, 2026 · Assigned by GitHub_M
CVE-2026-41178OpenTelemetry-Go's baggage parsing no longer caps raw header length
Medium 5.3
In plain English
A medium-severity security flaw in go.opentelemetry.io/otel/baggage from open-telemetry. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 72.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | opentelemetry-collector | 0.152.1-2.el10_2 | ALSA-2026:65116 |
| AlmaLinux:9 | opentelemetry-collector | 0.152.1-2.el9_8 | ALSA-2026:65117 |
| AlmaLinux:10 | osbuild-composer | 165.1-5.el10_2.alma.1 | ALSA-2026:66432 |
| AlmaLinux:8 | osbuild-composer | 101.5-3.el8_10.alma.1 | ALSA-2026:67148 |
| AlmaLinux:9 | osbuild-composer | 165.1-5.el9_8.alma.1 | ALSA-2026:69293 |
| AlmaLinux:10 | osbuild-composer-core | 165.1-5.el10_2.alma.1 | ALSA-2026:66432 |
| AlmaLinux:8 | osbuild-composer-core | 101.5-3.el8_10.alma.1 | ALSA-2026:67148 |
| AlmaLinux:9 | osbuild-composer-core | 165.1-5.el9_8.alma.1 | ALSA-2026:69293 |
| AlmaLinux:10 | osbuild-composer-worker | 165.1-5.el10_2.alma.1 | ALSA-2026:66432 |
| AlmaLinux:8 | osbuild-composer-worker | 101.5-3.el8_10.alma.1 | ALSA-2026:67148 |
| AlmaLinux:9 | osbuild-composer-worker | 165.1-5.el9_8.alma.1 | ALSA-2026:69293 |
| Debian:12 | golang-opentelemetry-otel | no fix listed | DEBIAN-CVE-2026-41178 |
| Debian:13 | golang-opentelemetry-otel | no fix listed | DEBIAN-CVE-2026-41178 |
| Debian:14 | golang-opentelemetry-otel | 1.46.0-2 | DEBIAN-CVE-2026-41178 |
| Go | go.opentelemetry.io/otel | 1.42.0, 1.44.0 | GO-2026-5158 |
| Go | go.opentelemetry.io/otel/baggage | 1.44.0 | GHSA-5wrp-cwcj-q835 |
| Go | go.opentelemetry.io/otel/baggage | 1.42.0 | GHSA-5wrp-cwcj-q835 |
| Go | go.opentelemetry.io/otel/propagation | 1.44.0 | GHSA-5wrp-cwcj-q835 |
| Go | go.opentelemetry.io/otel/propagation | 1.42.0 | GHSA-5wrp-cwcj-q835 |
| Rocky Linux:10 | image-builder | 0:52.1-2.el10_2.rocky.0.1 | RLSA-2026:67139 |
| Rocky Linux:9 | image-builder | 0:52.1-2.el9_8 | RLSA-2026:67138 |
| Rocky Linux:10 | opentelemetry-collector | 0:0.152.1-2.el10_2 | RLSA-2026:65116 |
| Rocky Linux:9 | opentelemetry-collector | 0:0.152.1-2.el9_8 | RLSA-2026:65117 |
| Rocky Linux:10 | osbuild-composer | 0:165.1-5.el10_2.rocky.0.1 | RLSA-2026:66432 |
| Rocky Linux:8 | osbuild-composer | 0:101.5-3.el8_10.rocky.0.6 | RLSA-2026:67148 |
| Rocky Linux:9 | osbuild-composer | 0:165.1-5.el9_8.rocky.0.1 | RLSA-2026:69293 |
| Ubuntu:22.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-41178 |
| Ubuntu:24.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-41178 |
| Ubuntu:25.10 | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-41178 |
| Ubuntu:26.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-41178 |
| Ubuntu:26.10 | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-41178 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | go.opentelemetry.io/otel/baggage | = 1.41.0= 1.43.0 |
| open-telemetry | go.opentelemetry.io/otel/propagation | = 1.41.0= 1.43.0 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L