Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-29181 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

Produits et versions touchés

Produit Versions touchées Corrigé en
opentelemetry-go 1.36 1.36.0 → < 1.41.0 1.41.0
multicluster engine for Kubernetes 2.11 1780917881 premières → < 1780917881 1780917881
Multicluster Engine for Kubernetes Versions non publiées
Red Hat Advanced Cluster Management for Kubernetes 2 Versions non publiées
multicluster engine for Kubernetes 2.11.0 1780917881 premières → < 1780917881 1780917881
multicluster engine for Kubernetes 2.8 1784738758 premières → < 1784738758 1784738758
cert-manager Operator for Red Hat OpenShift Versions non publiées
Logging Subsystem for Red Hat OpenShift Versions non publiées
Cluster Observability Operator 1.5.0 1787593637 premières → < 1787593637 1787593637
Afficher les 2 autres branches
Produit Versions touchées Corrigé en
Cert Manager support for Red Hat OpenShift release 1.19 1788348594 premières → < 1788348594 1788348594
Logging Subsystem for Red Hat OpenShift 6.6 1788439505 premières → < 1788439505 1788439505

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de opentelemetry-go

Les 9 CVE de opentelemetry-go →
CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry 6.3 Moyenne CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry 6.3 Moyenne CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry 5.1 Moyenne CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry 2.0 Faible
Suivre cette CVE