HackZoneLabs News
Newsletter

CVE-2026-128086

OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

  • Medium 5.3

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into internal/baggage.Item. A valid densely populated baggage header can therefore cause allocation traffic and retained memory disproportionate to its bounded input size. Remote impact requires baggage extraction to be enabled, attacker-controlled input to reach it, and extraction to run before authentication or on a public route; the evidence establishes increased allocation and garbage-collection pressure but not reliable process termination. This issue is fixed in version 1.47.0.

Key facts

Published
13 Nov 2026
Last changed
13 Nov 2026
Assigned by
GitHub_M
EPSS
0.436% likely to be exploited in the next 30 days, higher than 38.468% of CVEs (scores for 15 Nov 2026)

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 5.3CVSS 3.1, Mediumfrom the CNA (GitHub_M)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
open-telemetryopentelemetry-go
  • >= 1.0.0-RC1, < 1.47.0 (affected)

Timeline

  1. 13 Nov 2026 Published

Weakness

References