VYPR
← All advisories
Medium severity5.3GHSA Advisory· Published Jun 4, 2026· Updated Jul 22, 2026

CVE-2026-41178

CVE-2026-41178

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes Parse to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
go.opentelemetry.io/otel/baggageGo
>= 1.41.0, < 1.42.01.42.0
go.opentelemetry.io/otel/propagationGo
>= 1.41.0, < 1.42.01.42.0
go.opentelemetry.io/otel/baggageGo
>= 1.43.0, < 1.44.01.44.0
go.opentelemetry.io/otel/propagationGo
>= 1.43.0, < 1.44.01.44.0

Affected products

2767

Patches

Vulnerability mechanics

References

4

News mentions

1