CVE-2026-41178

MediumCVSS 5.3/10Last modified Jul 22, 2026

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-789

Affected software

Vendor	Product	Versions
open-telemetry	go.opentelemetry.io/otel/baggage	= 1.41.0; = 1.43.0
open-telemetry	go.opentelemetry.io/otel/propagation	= 1.41.0; = 1.43.0

References

https://github.com/open-telemetry/opentelemetry-go/pull/7880Issue Tracking, Patch
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835Issue Tracking, Patch, Vendor Advisory
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Jun 4, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-411799.8Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and CVE-2026-41184.3The Call To Action Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.3. This CVE-2026-411807.5PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` val CVE-2026-411815.8Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information disclosure vulnerabili CVE-2026-411825.3LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0 CVE-2026-411834.3FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct c CVE-2026-411846.5In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the _CVE-2026-411856.5When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet informat CVE-2026-411867.5When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof CVE-2026-411876.5Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on Netwo CVE-2026-411897.1FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `Threa CVE-2026-41199.1The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin regist