AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-mh2q-q3fh-2475: OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

highvulnerability

security

Source: GitHub Advisory DatabaseApril 7, 2026CVE-2026-29181

Summary

OpenTelemetry-Go has a denial-of-service vulnerability where the library parses multiple `baggage` HTTP headers (a standard for distributed tracing metadata) separately instead of treating them as one combined value. An attacker can send many baggage header lines to force the server to waste CPU and memory on repeated parsing work, even though each individual header stays within size limits, causing high latency and excessive allocations per request.

Solution / Mitigation

The source recommends: "avoid repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing. one mitigation approach is to treat multi-values as a single comma-joined string and cap total parsed bytes (for example 8192 bytes total)." The fix is accepted when allocations and parsing operations stay within 2x of baseline and response latency (p95) stays below 2ms.