Go/go.opentelemetry.io/otel CVE-2026-29181: high 7.5, EPSS 0.79%

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Action: Upgrade go.opentelemetry.io/otel to 1.41.0 or later.

go get go.opentelemetry.io/otel@v1.41.0

Affected

Fixed versions

Sources

• osv: GHSA-mh2q-q3fh-2475
• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
• https://nvd.nist.gov/vuln/detail/CVE-2026-29181
• https://github.com/open-telemetry/opentelemetry-go/pull/7880
• https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f
• https://github.com/open-telemetry/opentelemetry-go
• https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0

CVE-2026-29181 · published 2026-04-07T20:12:57Z · modified 2026-09-10T03:51:02.265229173Z · JSON