All vulnerabilities
CVE-2026-116694GHSA-f5m9-jfrj-jjj7

opentelemetry-propagator-jaeger: OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

open-telemetry opentelemetry-propagator-jaegerpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in1.45.0Fixed versionGitHub
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 1.45.0opentelemetry-propagator-jaeger, pipGitHub
  • 1.45.0opentelemetry-propagator-jaeger, PyPIOSVpip install "opentelemetry-propagator-jaeger>=1.45.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

JaegerPropagator.extract() in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx-* baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept.

Impact

Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits.

The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration.

Common Python web servers also constrain request headers before they reach the propagator:

  • Gunicorn allows a maximum of 100 request-header fields and 8,190 bytes per field by default.
  • Uvicorn’s h11 implementation limits its incomplete-event buffer to 16,384 bytes by default.

The risk is higher for non-HTTP transports, custom TextMapGetter implementations, or deployments where server and gateway limits have been increased or disabled.

The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution.

Patches

Versions of opentelemetry-propagator-jaeger earlier than 1.45.0 are affected.

Upgrade opentelemetry-propagator-jaeger to version 1.45.0 or later.

Version 1.45.0 limits extraction to 180 entries and 8,192 total bytes and skips entries larger than 4,096 bytes.

Credit

tonghuaroot

Text from GitHub Advisory Database

Affected versions 53

  • opentelemetry-propagator-jaeger, pip<= 1.44.0GitHub
  • opentelemetry-pythonaffected: < 1.45.0CVE List
  • opentelemetry-propagator-jaeger, PyPIfrom first release, fixed in 1.45.0OSV
  • opentelemetry-propagator-jaeger, PyPI0.17b0OSV
  • opentelemetry-propagator-jaeger, PyPI1.0.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.0.0rc1OSV
  • opentelemetry-propagator-jaeger, PyPI1.1.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.10.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.11.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.11.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.12.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.12.0rc1OSV
  • opentelemetry-propagator-jaeger, PyPI1.12.0rc2OSV
  • opentelemetry-propagator-jaeger, PyPI1.13.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.14.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.15.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.16.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.17.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.18.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.19.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.2.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.20.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.21.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.22.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.23.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.24.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.25.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.26.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.27.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.28.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.28.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.28.2OSV
  • opentelemetry-propagator-jaeger, PyPI1.29.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.3.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.30.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.31.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.31.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.32.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.32.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.33.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.33.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.34.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.34.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.35.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.36.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.37.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.38.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.39.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.39.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.4.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.4.1OSV
  • opentelemetry-propagator-jaeger, PyPI1.40.0OSV
  • opentelemetry-propagator-jaeger, PyPI1.41.0OSV

References 5