AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-rcgg-9c38-7xpx: OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

mediumvulnerability

security

Source: GitHub Advisory DatabaseMay 14, 2026CVE-2026-45292

Summary

OpenTelemetry Java's baggage propagation (the mechanism for passing request context data across services) didn't enforce size limits, causing unbounded memory allocation (unlimited memory usage) and CPU consumption when parsing oversized baggage headers. This problem can spread to downstream services that never received the original malicious request because baggage is automatically re-injected into every outgoing request.

Solution / Mitigation

Update to version 1.62.0 or later. The fix enforces limits consistent with the W3C Baggage specification: maximum total baggage size of 8,192 bytes and maximum 64 entries. Headers exceeding either limit are dropped at the point the limit is reached, while already-extracted valid entries are retained.