Skip to content
fr Sign in
7.5 High

CVE-2026-29181 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

Affected products and versions

Product Affected versions Fixed in
opentelemetry-go 1.36 1.36.0 → < 1.41.0 1.41.0
multicluster engine for Kubernetes 2.11 1780917881 earliest → < 1780917881 1780917881
Multicluster Engine for Kubernetes Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
multicluster engine for Kubernetes 2.11.0 1780917881 earliest → < 1780917881 1780917881
multicluster engine for Kubernetes 2.8 1784738758 earliest → < 1784738758 1784738758
cert-manager Operator for Red Hat OpenShift Versions not published
Logging Subsystem for Red Hat OpenShift Versions not published
Cluster Observability Operator 1.5.0 1787593637 earliest → < 1787593637 1787593637
Show the 2 other branches
Product Affected versions Fixed in
Cert Manager support for Red Hat OpenShift release 1.19 1788348594 earliest → < 1788348594 1788348594
Logging Subsystem for Red Hat OpenShift 6.6 1788439505 earliest → < 1788439505 1788439505

References

Timeline

  1. Published
  2. Last modified

Other CVEs of opentelemetry-go

The 9 CVEs of opentelemetry-go →
CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry 6.3 Medium CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry 6.3 Medium CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry 5.1 Medium CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry 2.0 Low
Track this CVE