go.opentelemetry.io/otel vulnerabilities (Go)

2 vulnerabilities.

• go.opentelemetry.io/otel Go OpenTelemetry-Go's baggage parsing no longer caps raw header length CVE-2026-41178 Fix available 5.3 MediumMay 28, 2026
• go.opentelemetry.io/otel Go OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVE-2026-29181 Fix available 7.5 HighApril 7, 2026