High 7.5Published Apr 7, 2026

CVE-2026-29181OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

Updated under an hour ago (Oct 28, 2026, 3:50 AM ET)

Does this affect you?

It affects open-telemetry opentelemetry-go and 6 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for open-telemetry opentelemetry-go

Exploited in the last 30 days

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-770
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Modified
Record last updated: Sep 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

open-telemetry opentelemetry-go open_telemetry:opentelemetry_go (from the name)	from 1.36.0, < 1.41.0	CNA record
Red Hat Cert Manager support for Red Hat OpenShift release 1.19 redhat:cert_manager	from 1788348594 not affected	CISA ADP
Red Hat Cluster Observability Operator 1.5.0 redhat:cluster_observability_operator	from 1787593637 not affected	CISA ADP
Red Hat Logging Subsystem for Red Hat OpenShift 6.6 redhat:logging	from 1788439505 not affected	CISA ADP
Red Hat multicluster engine for Kubernetes 2.11 redhat:multicluster_engine	from 1780917881 not affected	CISA ADP
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2 redhat:acm	2	CISA ADP
opentelemetry opentelemetry opentelemetry:opentelemetry	from 1.36.0 before 1.41.0	NVD

References

References

https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475	x-refsource-confirm, exploit, vendor-advisory
https://access.redhat.com/errata/RHSA-2026:25271
https://access.redhat.com/errata/RHSA-2026:47735
https://access.redhat.com/errata/RHSA-2026:61314
https://access.redhat.com/errata/RHSA-2026:63140
https://access.redhat.com/errata/RHSA-2026:66521
https://access.redhat.com/security/cve/CVE-2026-29181
https://bugzilla.redhat.com/show_bug.cgi?id=2456252
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.