CVE-2026-45292

MediumCVSS 5.3

Published: 28/05/2026(UTC)Updated: 10/09/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.10%

64th percentile - higher than 64% of all known CVEs

Summary

The Java implementation of OpenTelemetry (opentelemetry-api and opentelemetry-extension-trace-propagators) before version 1.62.0 is vulnerable to oversized baggage processing, causing unbounded memory allocation and CPU consumption. Baggage is automatically re-injected into outgoing requests, potentially spreading the attack to downstream services.

Risk Assessment

A DoS attack can overwhelm the server and dependent services, causing application downtime.

Recommendation

Update the opentelemetry-java libraries to version 1.62.0 or later.

Other vulnerabilities in opentelemetry-java

CVE-2026-118259Medium
opentelemetry-java before 1.67.0 has a vulnerability in W3CTraceContextPropagator.extract() where regex delimiter processing can exhibit quadratic backtracking when parsing tracestate headers with long runs of spaces or tabs without a following comma. An unauthenticated attacker can block request threads and cause excessive CPU consumption.

Original NVD description (English source)

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS