Memory allocation vulnerability in OpenTelemetry-Go from 1.0.0-RC1 to 1.47.0

CVE-2026-128086

What is CVE-2026-128086?

The vulnerability in OpenTelemetry-Go versions 1.0.0-RC1 through 1.47.0 involves a flaw in the baggage parsing and extraction mechanisms. Specifically, the baggage.Parse and propagation.Baggage.Extract functions eagerly materialize every W3C baggage property, leading to excessive memory allocation and garbage collection pressure under certain conditions. If an attacker can provide a valid, densely populated baggage header and initiate the extraction process on a public route or prior to authentication, it can result in disproportionate allocation traffic, impacting application performance. This issue has been addressed in version 1.47.0, and users are encouraged to update to mitigate potential risks.

References