AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-8988-4f7v-96qf: OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation

mediumvulnerability

security

Source: GitHub Advisory DatabaseJune 15, 2026CVE-2026-54285

Summary

The W3CBaggagePropagator.extract() function in OpenTelemetry Core does not limit the size of incoming baggage HTTP headers, allowing unbounded memory allocation. While Node.js's default header size limit (16,384 bytes) provides some protection, systems without this limit or using non-HTTP transports (alternative communication methods like messaging systems) are at higher risk.

Solution / Mitigation

Update @opentelemetry/core to version 2.8.0 or later. The fix enforces the W3C Baggage specification limits at the propagator level: maximum total baggage size of 8,192 bytes, maximum 180 entries, and maximum per-entry size of 4,096 bytes. Headers exceeding these limits are truncated. Additionally, the source recommends configuring header size limits at the server or gateway level, and for non-HTTP transports receiving baggage from untrusted sources, validate input size before passing it to the propagator.