CVE-2026-116694

MediumCVSS 6.3

Published: 27/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 27/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

32th percentile - higher than 32% of all known CVEs

Summary

In OpenTelemetry Python prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. When an untrusted carrier supplies numerous or oversized values, the service performs unnecessary CPU work and short-lived heap allocations, contributing to denial of service.

Risk Assessment

An attacker can remotely trigger a denial of service against services with the Jaeger propagator enabled. Default Python HTTP server limits reduce practical impact, but custom getters or raised header limits increase exposure.

Recommendation

Upgrade OpenTelemetry Python to version 1.45.0 or later. Consider enforcing header size limits at the transport layer and disabling the Jaeger propagator if unused.

Other vulnerabilities in OpenTelemetry Python

CVE-2026-114603Medium
OpenTelemetry Python prior to 1.45.1 contains the TraceState.from_header function, which parses inbound W3C tracestate headers with an unbounded optional-whitespace regular expression. A malformed header containing a long run of spaces or tabs without a following comma causes quadratic backtracking, leading to excessive CPU consumption on a single unauthenticated request.

Original NVD description (English source)

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS