Allocation of Resources Without Limits or Throttling in opentelemetry-java - CVE-2026-45292
Published: July 21, 2026
Vulnerability identifier: #VU138924
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-45292
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
Affected software
opentelemetry-java
How to mitigate CVE-2026-45292
Install updates from vendor's website.
opentelemetry-java - update to 1.62.0
External References
- https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f
- https://github.com/open-telemetry/opentelemetry-java/pull/8380
- https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0
- https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx
- https://access.redhat.com/errata/RHSA-2026:28573
- https://access.redhat.com/errata/RHSA-2026:36820
- https://access.redhat.com/security/cve/CVE-2026-45292
- https://bugzilla.redhat.com/show_bug.cgi?id=2482785
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45292.json