5.3
Medium
CVE-2026-45292 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing…
Description
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry-java 1.62 | earliest → < 1.62.0 | 1.62.0 |
| opentelemetry-api | 1.62.0 | No fix stated |
| opentelemetry-extension-trace-propagators | 1.62.0 | No fix stated |
| Red Hat Offline Knowledge Portal 1.2.6 | Versions not published | |
| Red Hat Data Grid 8 | Versions not published | |
| Red Hat OpenShift Dev Spaces | Versions not published | |
| Red Hat 3scale API Management Platform 2 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions not published | |
| Exploit Intelligence | Versions not published |
Show the 21 other branches Hide the 21 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Containers | Versions not published | |
| OpenShift Lightspeed | Versions not published | |
| OpenShift Serverless | Versions not published | |
| Red Hat AI Inference Server | Versions not published | |
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Versions not published | |
| Red Hat OpenShift AI (RHOAI) | Versions not published | |
| Red Hat Quay 3 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Red Hat Offline Knowledge Portal 1.2.7 1782239370 | earliest → < 1782239370 | 1782239370 |
| Red Hat OpenShift Dev Spaces 3.29 1782989367 | earliest → < 1782989367 | 1782989367 |
| Red Hat Offline Knowledge Portal 1.2.3 1782239370 | earliest → < 1782239370 | 1782239370 |
| Red Hat Data Grid 8.6.2 | Versions not published | |
| Red Hat Offline Knowledge Portal 1.2.4 1782239370 | earliest → < 1782239370 | 1782239370 |
| Red Hat Migration Toolkit for Applications 8.2 1784109883 | earliest → < 1784109883 | 1784109883 |
| Red Hat Offline Knowledge Portal 1.2.9 1782239370 | earliest → < 1782239370 | 1782239370 |
| Red Hat Offline Knowledge Portal 1.2.5 1782239370 | earliest → < 1782239370 | 1782239370 |
| Red Hat Offline Knowledge Portal 1.2.10 1782239370 | earliest → < 1782239370 | 1782239370 |
| Red Hat OpenShift AI 3.4 1787073479 | earliest → < 1787073479 | 1787073479 |
| Red Hat Offline Knowledge Portal 1.2.12 1782239370 | earliest → < 1782239370 | 1782239370 |
References
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified