{"affected":[{"product":"opentelemetry-go","source":"CNA: GitHub_M","vendor":"open-telemetry","versions":[{"status":"affected","version":">= 1.0.0-RC1, < 1.47.0"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"go.opentelemetry.io/otel/baggage","product":"go.opentelemetry.io/otel/baggage","source":"OSV GHSA-rrfc-gjm9-cgrj","vendor":"","versions":[{"events":[{"introduced":"1.0.0-RC1"},{"fixed":"1.47.0"}],"lessThan":"1.47.0","status":"affected","version":"1.0.0-RC1","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"Go","packageName":"go.opentelemetry.io/otel/propagation","product":"go.opentelemetry.io/otel/propagation","source":"OSV GHSA-rrfc-gjm9-cgrj","vendor":"","versions":[{"events":[{"introduced":"1.0.0-RC1"},{"fixed":"1.47.0"}],"lessThan":"1.47.0","status":"affected","version":"1.0.0-RC1","versionType":"semver"}]}],"cveId":"CVE-2026-128086","cwes":["CWE-400","CWE-405"],"description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into internal/baggage.Item. A valid densely populated baggage header can therefore cause allocation traffic and retained memory disproportionate to its bounded input size. Remote impact requires baggage extraction to be enabled, attacker-controlled input to reach it, and extraction to run before authentication or on a public route; the evidence establishes increased allocation and garbage-collection pressure but not reliable process termination. This issue is fixed in version 1.47.0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1794597306357,"publishedAt":1794596055661,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-rrfc-gjm9-cgrj"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-go/pull/9024"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-go/commit/f09d1de32f4ac7e5ef16394533721106b1a57b89"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.47.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-rrfc-gjm9-cgrj"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-rrfc-gjm9-cgrj"}],"remediation":[{"kind":"fix","source":"OSV GHSA-rrfc-gjm9-cgrj","text":"go.opentelemetry.io/otel/baggage (Go): OSV reports a fixed version 1.47.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-rrfc-gjm9-cgrj"},{"kind":"fix","source":"OSV GHSA-rrfc-gjm9-cgrj","text":"go.opentelemetry.io/otel/propagation (Go): OSV reports a fixed version 1.47.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-rrfc-gjm9-cgrj"}],"revision":"9ceda217536d60647f6da6bcefb0f6f037a3d42a6b643f1f158d85c736c6fe2f","sources":[{"modifiedAt":1794596055661,"name":"CNA: GitHub_M","retrievedAt":1794597924577,"url":"https://www.cve.org/CVERecord?id=CVE-2026-128086"},{"modifiedAt":1794597306357,"name":"OSV / GitHub Security Advisories","retrievedAt":1794597925157,"url":"https://osv.dev/vulnerability/GHSA-rrfc-gjm9-cgrj"}],"ssvc":null,"status":"published","title":"OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification","updatedAt":1794597925157}