CVE-2026-29181
2 advisories.
Go/go.opentelemetry.io/otel CVE-2026-29181: high 7.5
OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)
Action: Upgrade go.opentelemetry.io/otel to 1.41.0 or later.
go get go.opentelemetry.io/otel@v1.41.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.36.0 | 1.41.0 | - |
Fixed versions
| 1.41.0 |
Sources
- osv: GHSA-mh2q-q3fh-2475
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
- https://nvd.nist.gov/vuln/detail/CVE-2026-29181
- https://github.com/open-telemetry/opentelemetry-go/pull/7880
- https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f
- https://github.com/open-telemetry/opentelemetry-go
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0
CVE-2026-29181 · published · modified · JSON
Go/go.opentelemetry.io/otel CVE-2026-29181: unknown
OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel
Action: Upgrade go.opentelemetry.io/otel to 1.41.0 or later.
go get go.opentelemetry.io/otel@v1.41.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.36.0 | 1.41.0 | - |
Fixed versions
| 1.41.0 |
Sources
- osv: GO-2026-5506
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
- https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f
- https://github.com/open-telemetry/opentelemetry-go/pull/7880
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0
CVE-2026-29181 · published · modified · JSON