GHSA-5wrp-cwcj-q835: opentelemetry-go's baggage parsing no longer caps raw header length
Summary
A removed safety check in OpenTelemetry Go's baggage parsing (the mechanism for passing contextual data between services) allows attackers to send extremely large or malformed baggage headers that consume excessive CPU and memory while being fully processed and logged, creating a denial-of-service vulnerability. The parser no longer rejects oversized inputs upfront and instead processes every invalid member completely, sending errors to the logging system by default.
Vulnerability Details
EPSS: 0.0%
Yes
May 28, 2026
Classification
Affected Vendors
Affected Packages
Related Issues
CVE-2022-29200: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implem
CVE-2021-29541: TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a dereference of a null p
Original source: https://github.com/advisories/GHSA-5wrp-cwcj-q835
First tracked: May 28, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 75%