{"id":"CVE-2026-45292","summary":"opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation","details":"opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.","aliases":["GHSA-rcgg-9c38-7xpx"],"modified":"2026-08-16T08:07:20.448433Z","published":"2026-05-28T16:37:29.490Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45292.json"},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45292.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28573"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41951"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-45292"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45292.json"},{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45292"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482785"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-java/pull/8380"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-telemetry/opentelemetry-java","events":[{"introduced":"0"},{"introduced":"d03621fb3c3aa7f31d31b684ada2e9a8a93f158a"},{"fixed":"03837d3c1763bc35464aea1078671e2ef2336a5f"},{"fixed":"d03621fb3c3aa7f31d31b684ada2e9a8a93f158a"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.62.0"},{"introduced":"1.62.0"},{"last_affected":"1.62.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["1.62.0","v1.12.0","v1.11.0","v1.10.0","v1.10.0-rc.2","v1.10.0-rc.1","v1.9.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v0.17.0","v0.16.0","v0.15.0","v0.14.0","v0.13.0","v0.12.0","v0.11.0","v0.10.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45292.json","vanir_signatures_modified":"2026-08-16T08:07:20Z","vanir_signatures":[{"source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java","function":"putBaggage"},"deprecated":false,"digest":{"length":332,"function_hash":"228950356609877868758791773050477987897"},"id":"CVE-2026-45292-0f735734","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java","function":"baggageToString"},"deprecated":false,"digest":{"function_hash":"309334547631565040319040629272525574479","length":572},"id":"CVE-2026-45292-1832a659","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["101447758375284263948653778924649079016","147333328675828053810151871517722132937","200744724238036848902017928333672617241","183992973757728204299737840062866885954","53562218041366311605399652144696834748","68279050571543324039906946472774706896","262089102782194850447234319751262558355","95685806190671045297024763373365639859","160145683896610303744686241164658037883","148729382876915712334932268350176933519","334957753244604684699178766247491690474","231238799032561628781206441842588202033","127867779465824305634121116988717328922","259906127412495501315534019782483132884","68523714707972739852901428267813802985","190004690390445008988815686517467481243","272053739604272298851157136930905059618","69628561152478518786006821070779828464","216199204779542520378088291092043111077"],"threshold":0.9},"id":"CVE-2026-45292-2df25772","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java"}},{"digest":{"function_hash":"324040298607633099239747925521181692285","length":94},"id":"CVE-2026-45292-3217a024","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java","function":"extractEntries"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java"},"deprecated":false,"digest":{"line_hashes":["2736157610361857025527732691065087203","86435547091767786361426411324429584358","41177967652305490077281618619690476460","53056691527998116437139607088840810649","200444032932188625533046905973486136310","322215403787429048323761220146177576815","340130063425991297414784349311592936190","52000232421443451450877966028549862428","229650805912405071560475496753778742245","200966310157433461865540336404663962630","290686205111362739751168408941015981435","226379763402180177718224749577998004598","293742249982255448599687901397687808266","128115566370171621987030639128416822867","128063808075106022048355774255772526981","220765276456906269112572466292227184726","235302921452623369068620557109957356399","148540107334669822672307653149093924506","231650651611206962808810877422094108649","161793007183578077616834888632390771327","110835381729137979723145489692899493645","7599191191882320167505444953349458675","339403475527353307448176744553962954099","289593621153771310375623480448877062179","29415257308678424589951977246591929667","241730058457481652234845595266595623415","47914828783880551553164836963674179323","280795312696270798208652171823018313137","225729826646794272243606684600811419553","244584886160422946585839938600532990305","284149173263861833489906033555612198803","113866770370623367670363381828884451198","174449262980615703894916509034162717800","39166625609584491556473546578842242931","193910834392300100989649934959087756365","153985727346855901549590759067985026754","242564297933134908170296124984925163564","305455182349108538775657664142858524168","214875562571116176303512337697604680933","327691809867499953730582283444104874265","190701536751006470679815687929121470314","309691432462170197969715861949115981023","99135934049104599925931164446588462403"],"threshold":0.9},"id":"CVE-2026-45292-3b0e2afc"},{"deprecated":false,"digest":{"length":473,"function_hash":"18398855200978346088302344929080993256"},"id":"CVE-2026-45292-4b8b0853","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java","function":"extractMulti"}},{"deprecated":false,"digest":{"function_hash":"289875203222079088686919194446068685093","length":693},"id":"CVE-2026-45292-51caa593","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java","function":"inject"}},{"target":{"file":"extensions/trace-propagators/src/test/java/io/opentelemetry/extension/trace/propagation/OtTracePropagatorTest.java"},"deprecated":false,"digest":{"line_hashes":["57422983355185685798677884843937778398","86471840035482204802109395694954600873","239987252347493383961100522199334614303","166750851672169983731451394049415691860","230187549525644793848853761859914754642","137664863221316513551598494816248060484","264023897608771092923793707284935983213","214561367730798019122639144325961192990","224551665289327638480037572783293209200","255744619664452528395280925254114108237","44582178634639660520984032379100376832","329340391870657849627795609049280505588","131871532952430929400321684155676094120","7926157107541989220678153033410614323","336948967958980590273334651720366142188","268844915984555954091136723938662598922","298721777215713470840312602678433837423"],"threshold":0.9},"id":"CVE-2026-45292-5457b19b","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"},{"target":{"function":"injectBaggage","file":"extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java"},"deprecated":false,"digest":{"function_hash":"16057343206135996351300200025482210473","length":202},"id":"CVE-2026-45292-61299af3","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java","function":"extract"},"deprecated":false,"digest":{"length":1236,"function_hash":"325989081887590977161991403427085452360"},"id":"CVE-2026-45292-71a3cbde"},{"id":"CVE-2026-45292-80d5ec6e","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java","function":"parseBaggageHeader"},"deprecated":false,"digest":{"function_hash":"272028938564614111152577707812895728378","length":334}},{"target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java","function":"parseInto"},"deprecated":false,"digest":{"function_hash":"11031647112383166876003824258982174962","length":1551},"id":"CVE-2026-45292-91ec5843","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"api/all/src/test/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagatorTest.java"},"deprecated":false,"digest":{"line_hashes":["239345630250743580483968896944488439413","337034480761630260594198419762749273068","105171261500783072282133845295030967368","302142561053748229476123246783180390104","239574872035521831017091315731564658955","73951333417615050995495367384191892471","156004208839988196159896163803951028813","327844966003215203401321592027192772804","197588040595289848873249040457061994998","305767223277710999442536515673581540461","227297817023754502556516364711088397437","256240598407376171183108265241040949147","78833074397608598403735516491452787468","64323587913788000661923030633447762562","5812748884965767207211840640618430241","336390307670648052519699553053404448772","203074136614452997952031730341320237450","34815311774140407507144298041252954955"],"threshold":0.9},"id":"CVE-2026-45292-b879fafc"},{"deprecated":false,"digest":{"line_hashes":["33080079480296023145388178458139894476","2923213682616713978173602717812943260","28896537007609620556867889160382359779","123475029095939059690915194882056320776","119539450348303551703714467228488206882","124389229736369702492630146280660614404","183206172447372457926039324847483789068","214546313599121294249009182193536051778","81405965628241265660210608473733093391","24596351879490959764319191901809669688","329340391870657849627795609049280505588","283368615391408689722037177507991485186","236684645129237460536720298385424586785","152374337647870118177880266298173998168","174657051201628902770438195884818994992","72390310119854681659869645598363997275"],"threshold":0.9},"id":"CVE-2026-45292-cb8b011a","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"extensions/trace-propagators/src/test/java/io/opentelemetry/extension/trace/propagation/JaegerPropagatorTest.java"}},{"digest":{"line_hashes":["225563818499233367519022669779838315019","277714487139591758900983597709715611908","67785612765065382128031478595599195032","237121721588638052542475859018682851837","39540601855233475791007790758198444129","2031994772797113595152393846679653499","172624610666532659232895157331884203169","286622679712599912238124505164641853587","220806260929443147353265464079843191903","188663697407482894313058447745134838416","156976945363984426358817669915175673149","31520473516259012413094303550304700291","46033727661262132662501271637269650234","9810993886405726943558573783002640349","72375414593571301766433226169901390469","119801564351374144698840815379221974868","224138421188025658000231347261174208922","144585335175953505213391907047729891864","215023468345882789514941138672616764895","77147113895842293715888192562814974798","188392142685785950450023835311063741502","14887411100419948675168123558039147821","262366377240734211349481133880693438531","102614813815977114487314424211865996969","119997976285540997734493601518612964231","84712053147649686417702451363068651763","106723926582822914670304753730225338287","191785466615703180739792607217424534098","92715705812415012041431899488602445184","239900951165186684239348646971257232840","196655747857919072290822505179275858796","100149592621763266595244546171067718398","129289305148052155536605975208026808028","323358386069968239544135410951793021442","152908977494773281664915813969161000058","306013695714167092383886980704411086755","227271501807411227296581694400632553058","3767369795944466534786766635767762622","121828939624704043642154626050702204704","227628861948579671534354922044173792301","313406723938225126255804049122573465064","109261829156171815691256093511460764140","313711046943558329276718594776674616847","177153116393120700348301308916413196081"],"threshold":0.9},"id":"CVE-2026-45292-cff19bb0","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java"},"deprecated":false},{"digest":{"function_hash":"288778143410670638095168990784169960099","length":821},"id":"CVE-2026-45292-ee0826fd","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java","function":"getBaggageFromHeader"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"294856610575432090025282065914156859268","length":68},"id":"CVE-2026-45292-eed10c13","signature_type":"Function","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f","target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java","function":"Parser"}},{"target":{"file":"api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java"},"deprecated":false,"digest":{"line_hashes":["144991873732987924352070841534908749276","113249383205500147450345369716031573471","67819586397585278965431929330641645003","243041489747333960372742448711995971626","287923327682074635675616588623859257505","11519041757850507829222762636861525651","78599831323481765895624604533738841437","190917584330989715769223351112918498164","286191209785037123426353571988930896822","217170081702381849486234240711059033903","156755348991413335325671692302735179952","134674499688784999131130620152179436432","128948794105523786542523631109305918866","188838211524901183685762391391601263058","75407180318704451699303769443305508093","108587633537507210242609878158511307392","316015335210385615884675010095580741713","172949875226896649181066246542847102669","71621010025911738797948271325213320837","329793816160020523949891269214878561399","176622313265287167532456455831121001161","90257972463375921783361897042811391098","311572496888965192775199114864530964575","326261317385562529874568081672142801835","221171341465066986048389800378139756222","228663846087108107510970641859131755953","79901192235391821134937543294836292522","108284150120597359644081533265565666360"],"threshold":0.9},"id":"CVE-2026-45292-fa77efcb","signature_type":"Line","signature_version":"v1","source":"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}