p PatchFirst

CVE-2026-116694

CVE-2026-116694 · OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.

CVSS 6.3 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • opentelemetry-python

    Versions
    • < 1.45.0: Affected

    No fix published

  • python-opentelemetry Debian:14

    Versions
    • 1.35.0-2
    • 1.38.0-1
    • 1.38.0-2
    • 1.39.1-1
    • 1.39.1-2
    • 1.40.0-1
    • 1.41.0-1
    • 1.41.0-2
    • 1.42.1-1
    • 1.43.0-1
    • 1.44.0-1
    • 1.44.0-2
    • 1.45.1-1
    • 1.45.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • opentelemetry-propagator-jaeger PyPI

    Versions
    • 0.17b0
    • 1.0.0
    • 1.0.0rc1
    • 1.1.0
    • 1.10.0
    • 1.11.0
    • 1.11.1
    • 1.12.0
    • 1.12.0rc1
    • 1.12.0rc2
    • 1.13.0
    • 1.14.0
    • 1.15.0
    • 1.16.0
    • 1.17.0
    • 1.18.0
    • 1.19.0
    • 1.2.0
    • 1.20.0
    • 1.21.0
    • 1.22.0
    • 1.23.0
    • 1.24.0
    • 1.25.0
    • 1.26.0
    • 1.27.0
    • 1.28.0
    • 1.28.1
    • 1.28.2
    • 1.29.0
    • 1.3.0
    • 1.30.0
    • 1.31.0
    • 1.31.1
    • 1.32.0
    • 1.32.1
    • 1.33.0
    • 1.33.1
    • 1.34.0
    • 1.34.1
    • 1.35.0
    • 1.36.0
    • 1.37.0
    • 1.38.0
    • 1.39.0
    • 1.39.1
    • 1.4.0
    • 1.4.1
    • 1.40.0
    • 1.41.0
    • 1.41.1
    • 1.42.0
    • 1.42.1
    • 1.43.0
    • 1.44.0
    • 1.5.0
    • 1.6.0
    • 1.6.1
    • 1.6.2
    • 1.7.0
    • 1.7.1
    • 1.8.0
    • 1.9.0
    • 1.9.1
    Affected ranges
    • ECOSYSTEM: < 1.45.0

    Update to 1.45.0

  • python-opentelemetry Ubuntu:26.10

    Versions
    • 1.39.1-2
    • 1.42.1-1
    • 1.43.0-1
    • 1.44.0-1
    • 1.44.0-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-opentelemetry Ubuntu:26.04:LTS

    Versions
    • 1.38.0-1
    • 1.38.0-2
    • 1.39.1-1
    • 1.39.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →