Maven/io.opentelemetry:opentelemetry-api CVE-2026-45292: medium 5.3, EPSS 1.10%
OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation
Action: Upgrade io.opentelemetry:opentelemetry-api to 1.62.0 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.62.0 | - |
Fixed versions
| 1.62.0 |
Sources
- osv: GHSA-rcgg-9c38-7xpx
- https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx
- https://nvd.nist.gov/vuln/detail/CVE-2026-45292
- https://github.com/open-telemetry/opentelemetry-java/pull/8380
- https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f
- https://github.com/open-telemetry/opentelemetry-java
- https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0
CVE-2026-45292 · published · modified · JSON