{"id":"CVE-2026-116694","title":"OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation","summary":"OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byt…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-770"],"vendor":"open-telemetry","product":"opentelemetry-python","affected":["opentelemetry-python < 1.45.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-28T14:34:44.239027Z"},"published":"2026-10-27","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:13:25.340Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116694","references":[{"url":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-f5m9-jfrj-jjj7","label":"https://github.com/open-telemetry/opentelemetry-python/security/advisories/GHSA-f5m9-jfrj-jjj7"},{"url":"https://github.com/open-telemetry/opentelemetry-python/pull/5556","label":"https://github.com/open-telemetry/opentelemetry-python/pull/5556"},{"url":"https://github.com/open-telemetry/opentelemetry-python/commit/65c4eeb87cd3815dc795d3b5485e9ea0d5affcc7","label":"https://github.com/open-telemetry/opentelemetry-python/commit/65c4eeb87cd3815dc795d3b5485e9ea0d5affcc7"},{"url":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.0","label":"https://github.com/open-telemetry/opentelemetry-python/releases/tag/v1.45.0"},{"url":"https://github.com/advisories/GHSA-f5m9-jfrj-jjj7"}],"tags":["cve.org","ghsa","pip"],"epss":0.00378,"epssPercentile":0.31643,"aliases":["GHSA-f5m9-jfrj-jjj7"],"ecosystem":"pip","patched":["opentelemetry-propagator-jaeger 1.45.0"],"ingestedAt":"2026-10-27T20:56:38.462Z","slug":"CVE-2026-116694","body":"## Overview\n\nOpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.\n\n## Affected\n\n- `opentelemetry-python < 1.45.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-116694)\n\nAffected packages:\n\n- `opentelemetry-propagator-jaeger <= 1.44.0`\n\nPatched in:\n\n- `opentelemetry-propagator-jaeger 1.45.0`\n\nSource: https://github.com/advisories/GHSA-f5m9-jfrj-jjj7","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}