{"id":"CVE-2026-116694","aliases":["DEBIAN-CVE-2026-116694","EUVD-2026-111385","GHSA-f5m9-jfrj-jjj7","UBUNTU-CVE-2026-116694"],"status":"published","title":"OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00378,"percentile":0.322,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2026-10-27T20:09:06Z","modified":"2026-10-30T02:30:56Z","fixes":[{"ecosystem":"PyPI","package":"opentelemetry-propagator-jaeger","fixed_in":["1.45.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"python-opentelemetry","fixed_in":["1.45.1-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"opentelemetry-propagator-jaeger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.44.0"},{"fixed":"1.45.0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-opentelemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.45.1-1"}]}],"versions":["1.35.0-2","1.38.0-1","1.38.0-2","1.39.1-1","1.39.1-2","1.40.0-1","1.41.0-1","1.41.0-2","1.42.1-1","1.43.0-1","1.44.0-1","1.44.0-2"]},{"source":"osv","ecosystem":"PyPI","package":"opentelemetry-propagator-jaeger","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.45.0"}]}],"versions":["0.17b0","1.0.0","1.0.0rc1","1.1.0","1.10.0","1.11.0","1.11.1","1.12.0","1.12.0rc1","1.12.0rc2","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.21.0","1.22.0","1.23.0","1.24.0","1.25.0","1.26.0","1.27.0","1.28.0","1.28.1","1.28.2","1.29.0","1.3.0","1.30.0","1.31.0","1.31.1","1.32.0","1.32.1","1.33.0","1.33.1","1.34.0","1.34.1","1.35.0","1.36.0","1.37.0","1.38.0","1.39.0","1.39.1","1.4.0","1.4.1","1.40.0","1.41.0","1.41.1","1.42.0","1.42.1","1.43.0","1.44.0","1.5.0","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.8.0","1.9.0","1.9.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-opentelemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.39.1-2","1.42.1-1","1.43.0-1","1.44.0-1","1.44.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-opentelemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.38.0-1","1.38.0-2","1.39.1-1","1.39.1-2"]}],"products":[{"vendor":"open-telemetry","product":"opentelemetry-python"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-f5m9-jfrj-jjj7","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-python/pull/5556","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-python/commit/65c4eeb87cd3815dc795d3b5485e9ea0d5affcc7","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.0","tags":["x_refsource_MISC","web","report"]},{"url":"https://github.com/advisories/GHSA-f5m9-jfrj-jjj7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116694.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116694","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-116694","tags":["advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-python","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-116694","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116694","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-116694","title":"OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.","status":"published","published":"2026-10-27T20:09:06.484Z","modified":"2026-10-28T16:13:25.34Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-111385","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.","status":"published","published":"2026-10-27T20:09:06Z","modified":"2026-10-28T16:13:25Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:59:20.41252Z"}],"ghsa":[{"id":"GHSA-f5m9-jfrj-jjj7","title":"OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation","description":"## Summary\n\n`JaegerPropagator.extract()` in `opentelemetry-propagator-jaeger` did not enforce limits when extracting inbound `uberctx-*` baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept.\n\n## Impact\n\nServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits.\n\nThe practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration.\n\nCommon Python web servers also constrain request headers before they reach the propagator:\n\n- Gunicorn allows a maximum of 100 request-header fields and 8,190 bytes per field by default.\n- Uvicorn’s h11 implementation limits its incomplete-event buffer to 16,384 bytes by default.\n\nThe risk is higher for non-HTTP transports, custom `TextMapGetter` implementations, or deployments where server and gateway limits have been increased or disabled.\n\nThe impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution.\n\n## Patches\n\nVersions of `opentelemetry-propagator-jaeger` earlier than `1.45.0` are affected.\n\nUpgrade `opentelemetry-propagator-jaeger` to version `1.45.0` or later.\n\nVersion `1.45.0` limits extraction to 180 entries and 8,192 total bytes and skips entries larger than 4,096 bytes.\n\n## Credit\n\ntonghuaroot","status":"published","published":"2026-10-27T21:06:54Z","modified":"2026-10-27T21:06:56Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:41:38.969831Z"}],"nvd":[{"id":"CVE-2026-116694","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.","status":"published","published":"2026-10-27T21:18:05.323Z","modified":"2026-10-28T17:18:05.527Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:13:04.037468Z"}],"osv":[{"id":"CVE-2026-116694","title":"OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.","status":"published","published":"2026-10-27T20:09:06.484Z","modified":"2026-10-30T02:30:56.831837547Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:56.675758Z"},{"id":"DEBIAN-CVE-2026-116694","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.","status":"published","published":"2026-10-27T21:18:05.323Z","modified":"2026-10-29T23:00:07.691747336Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:50.923612Z"},{"id":"GHSA-f5m9-jfrj-jjj7","title":"OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation","description":"## Summary\n\n`JaegerPropagator.extract()` in `opentelemetry-propagator-jaeger` did not enforce limits when extracting inbound `uberctx-*` baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept.\n\n## Impact\n\nServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits.\n\nThe practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration.\n\nCommon Python web servers also constrain request headers before they reach the propagator:\n\n- Gunicorn allows a maximum of 100 request-header fields and 8,190 bytes per field by default.\n- Uvicorn’s h11 implementation limits its incomplete-event buffer to 16,384 bytes by default.\n\nThe risk is higher for non-HTTP transports, custom `TextMapGetter` implementations, or deployments where server and gateway limits have been increased or disabled.\n\nThe impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution.\n\n## Patches\n\nVersions of `opentelemetry-propagator-jaeger` earlier than `1.45.0` are affected.\n\nUpgrade `opentelemetry-propagator-jaeger` to version `1.45.0` or later.\n\nVersion `1.45.0` limits extraction to 180 entries and 8,192 total bytes and skips entries larger than 4,096 bytes.\n\n## Credit\n\ntonghuaroot","status":"published","published":"2026-10-27T21:06:54Z","modified":"2026-10-27T21:15:03.81653184Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"UBUNTU-CVE-2026-116694","description":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.","status":"published","published":"2026-10-27T21:18:00Z","modified":"2026-10-28T20:17:45.948312762Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:00.081948Z"}]}}