Denial of Service Vulnerability in OpenTelemetry Python SDK by OpenTelemetry
CVE-2026-116694

6.3MEDIUM

Key Information:

Vendor

Open-telemetry

Status
Opentelemetry-python
Vendor
CVE Published:
27 October 2026

What is CVE-2026-116694?

OpenTelemetry Python SDK prior to version 1.45.0 contains a vulnerability in the JaegerPropagator.extract() function. This function processes inbound uberctx-* baggage values without proper entry, per-entry byte, or total-byte limits, resulting in the potential for denial of service. If an untrusted carrier sends numerous or oversized values, this can lead to excessive CPU usage and short-lived heap allocations. While common default Python HTTP server configurations might mitigate some effects, the risk remains significant, especially in environments with non-standard configurations or raised limits. Version 1.45.0 addresses this issue effectively.

Affected Version(s)

opentelemetry-python < 1.45.0

References

https://github.com/open-telemetry/opentelemetry-python/se...
x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-python/pu...
x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-python/co...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.