Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🟠 OpenTelemetry Go, DoS via Baggage Header Parsing, #CVE-2026-41178 (medium) -DC-May2026-12 https://dailycve.com/opentelemetry-go-dos-via-baggage-header-parsing-cve-2026-41178-medium-dc-may2026-12/
Post summary
A medium‑severity Denial‑of‑Service vulnerability in OpenTelemetry Go, caused by Baggage Header parsing, has been disclosed.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | opentelemetry | opentelemetry | - | go | - |
| App | opentelemetry | opentelemetry | 1.43.0 | go | - |