CVE-2026-116694Medium· 6.3▾ SunlitOpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byt…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.
opentelemetry-python < 1.45.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
opentelemetry-propagator-jaeger <= 1.44.0Patched in:
opentelemetry-propagator-jaeger 1.45.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114603Medium· 5.3OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
CVE-2026-45292Medium· 5.3opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API
CVE-2026-48496Medium· 6.2OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages
CVE-2026-104872Medium· 5.8OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications
CVE-2026-101917Medium· 5.3PyJWT is a Python implementation of JSON Web Token standards
CVE-2026-100650Medium· 6.5vLLM through 0.29.0 fetches and fully materializes remote or inline media before enforcing its documented media controls (the VLLM_MAX_AUDIO_CLIP_FILESIZE_MB compressed-audio size cap, default 25 MB, and the per-modality --limit-mm-per-p…