Skip to content
Fencer Vulns
medium 5.3

CVE-2026-41178 json

OpenTelemetry-Go's baggage parsing no longer caps raw header length

published 2026-05-28 5 mo ago modified 2026-09-10 1 mo ago also GHSA-5wrp-cwcj-q835 , GO-2026-5158 , EUVD-2026-34288

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Patch / fix

  • go go.opentelemetry.io/otel/baggage 1.42.0, 1.44.0
  • go go.opentelemetry.io/otel/propagation 1.42.0, 1.44.0
  • go go.opentelemetry.io/otel 1.42.0, 1.44.0
  • opentelemetry opentelemetry 1.42.0
  • golang-opentelemetry-otel Debian 14 1.46.0-2

debian advisories DEBIAN-CVE-2026-41178

  • openshift openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el8
  • openshift openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el9
  • openshift-kubelet openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el9
  • openshift-hyperkube openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el8
  • openshift-hyperkube openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el9
  • openshift-kube-apiserver openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el9
  • openshift-kube-scheduler openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el9
  • openshift-kube-controller-manager openshift 4.22 4.22.0-202609141614.p2.g160626b.assembly.stream.el9

red hat advisories RHSA-2026:68550RHSA-2026:69293RHSA-2026:68527RHSA-2026:68334RHSA-2026:68335RHSA-2026:67975

  • helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
  • system-user-grafana SLE Module for Package Hub 15 SP7 1.0.0-150200.5.8.1
  • grafana SLE Module for Package Hub 15 SP7 12.4.10-150200.3.94.3
  • grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
  • mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
  • spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
  • uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
  • venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1

suse advisories SUSE-SU-2026:24282-1SUSE-SU-2026:4600-1SUSE-SU-2026:4585-1SUSE-SU-2026:24150-1SUSE-SU-2026:24148-1SUSE-SU-2026:4408-1

  • helmsman openSUSE Tumbleweed 4.0.5-1.1
  • kumactl openSUSE Tumbleweed 3.0.0-1.1
  • gh openSUSE Leap 16.0 2.102.0-bp160.1.1
  • grafana openSUSE Leap 16.0 12.4.10-bp160.1.1
  • gh openSUSE Tumbleweed 2.102.0-1.1
  • amazon-ecs-init openSUSE Leap 16.0 1.107.0-160000.1.1
  • alloy openSUSE Leap 16.0 1.19.2-160000.1.1
  • helm openSUSE Leap 16.0 4.3.0-160000.1.1

opensuse advisories openSUSE-SU-2026:12292-1openSUSE-SU-2026:12300-1openSUSE-SU-2026:22134-1openSUSE-SU-2026:22125-1openSUSE-SU-2026:12163-1openSUSE-SU-2026:22035-1

  • osbuild-composer AlmaLinux 9 165.1-5.el9_8.alma.1
  • osbuild-composer-core AlmaLinux 9 165.1-5.el9_8.alma.1
  • osbuild-composer-worker AlmaLinux 9 165.1-5.el9_8.alma.1
  • osbuild-composer AlmaLinux 8 101.5-3.el8_10.alma.1
  • osbuild-composer-core AlmaLinux 8 101.5-3.el8_10.alma.1
  • osbuild-composer-worker AlmaLinux 8 101.5-3.el8_10.alma.1
  • osbuild-composer AlmaLinux 10 165.1-5.el10_2.alma.1
  • osbuild-composer-core AlmaLinux 10 165.1-5.el10_2.alma.1

almalinux advisories ALSA-2026:69293ALSA-2026:67148ALSA-2026:66432ALSA-2026:65116ALSA-2026:65117

  • osbuild-composer Rocky Linux 9 165.1-5.el9_8.rocky.0.1
  • image-builder Rocky Linux 9 52.1-2.el9_8
  • image-builder Rocky Linux 10 52.1-2.el10_2.rocky.0.1
  • osbuild-composer Rocky Linux 8 101.5-3.el8_10.rocky.0.6
  • osbuild-composer Rocky Linux 10 165.1-5.el10_2.rocky.0.1
  • opentelemetry-collector Rocky Linux 10 0.152.1-2.el10_2
  • opentelemetry-collector Rocky Linux 9 0.152.1-2.el9_8

rocky linux advisories RLSA-2026:69293RLSA-2026:67138RLSA-2026:67139RLSA-2026:67148RLSA-2026:66432RLSA-2026:65116

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-41178 updated cvss 7.5

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-istio-csr-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9-operator, agent-sandbox/agent-sandbox-rhel9-operator, openshift-sandboxed-containers/osc-monitor-rhel9 Red Hat Cryostat 4 cryostat/cryostat-rhel9-operator Red Hat File Integrity Operator compliance/openshift-compliance-rhel8-operator, compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle Red Hat Migration Toolkit for Applications 8 mta/mta-java-external-provider-rhel9
    affected: no fix available
  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/maestro-rhel9, multicluster-engine/assisted-installer-rhel8, multicluster-engine/assisted-installer-rhel9, multicluster-engine/assisted-service-8-rhel8, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/image-based-install-rhel9, +9 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Lightspeed openshift-lightspeed/otelcol-lightspeed-rhel9, openshift-lightspeed/lightspeed-rhel9-operator, openshift-lightspeed/openshift-mcp-server-rhel9, openshift-lightspeed/lightspeed-agentic-rhel9-operator Red Hat OpenShift Pipelines openshift-pipelines-client, openshift-pipelines/pipelines-scheduler-rhel9 Red Hat OpenShift Serverless kn-workflow-plugin, openshift-serverless-clients, openshift-serverless-1/kn-plugin-func-func-util-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-proxyv2-rhel9 Red Hat Power monitoring for Red Hat OpenShift openshift-power-monitoring/power-monitoring-rhel9-operator
    affected: no fix available
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9, rhacm2/submariner-addon-rhel9, rhacm2/obo-prometheus-rhel9-operator
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-main-rhel9, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-roxctl-rhel9, advanced-cluster-security/rhacs-scanner-rhel8, advanced-cluster-security/rhacs-scanner-rhel9, +7 more
    affected: no fix planned “Will not fix”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9 Red Hat Ceph Storage 7 rhceph/grafana-rhel9 Red Hat Ceph Storage 8 rhceph/grafana-rhel9, rhceph/oauth2-proxy-rhel9 Red Hat Ceph Storage 9 rhceph/alloy-rhel10, rhceph/grafana-rhel10, rhceph/oauth2-proxy-rhel9, rhceph/oauth2-proxy-rhel10
    affected: no fix available “Fix deferred”
  • Red Hat Certification Program for Red Hat Enterprise Linux 9 redhat-certification-cnf, redhat-certification-preflight Red Hat Connectivity Link 1 rhcl-1/authorino-rhel9, rhcl-1/dns-rhel9-operator, rhcl-1/rhcl-rhel9-operator, rhcl-1/rhcl-operator-bundle, rhcl-1/limitador-rhel9-operator, rhcl-tech-preview/mcp-gateway-rhel9, +2 more
    affected: no fix available
show 10 more
  • Red Hat Enterprise Linux 9 rhel9/bootc-image-builder, rhel9-eus/rhel-9.6-bootc-image-builder Red Hat Enterprise Linux 10 grafana, grafana-pcp, rhel10/bootc-image-builder, rhel10-eus/rhel-10.0-bootc-image-builder
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-ml-pipelines-driver-rhel9, rhoai/odh-ml-pipelines-launcher-rhel9, rhoai/odh-ml-pipelines-api-server-v2-rhel9, rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9, rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9, rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, +1 more Red Hat OpenShift Cluster Manager CLI ocm-cli-clients/ocm-cli-rhel9
    affected: no fix available
  • Red Hat OpenShift Container Platform 4 ignition, microshift, microshift-olm, microshift-sriov, ignition-validate, microshift-multus, +39 more Red Hat OpenShift Container Platform 5 cri-o, ignition, cri-tools, openshift, microshift, openshift5/ose-thanos-rhel9, +51 more
    affected: no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/oauth2-proxy-rhel9 Red Hat OpenShift Dev Workspaces Operator devworkspace/devworkspace-project-clone-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-jaeger-query-rhel9, rhosdt/opentelemetry-target-allocator-rhel9 Red Hat OpenShift for Windows Containers openshift4-wincw/windows-machine-config-rhel9-operator, openshift4-wincw/windows-machine-config-operator-bundle Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8, openshift-gitops-1/dex-rhel9, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9 Red Hat OpenStack Platform 18.0 rhoso-operators/ovn-rhel9-operator, rhoso-operators/heat-rhel9-operator, rhoso-operators/nova-rhel9-operator, rhoso-operators/test-rhel9-operator, rhoso-operators/infra-rhel9-operator, rhoso-operators/swift-rhel9-operator, +18 more
    +1 more products
    Red Hat Trusted Artifact Signer rhtas/ec-rhel9, rhtas/rhtas-console-rhel9, rhtas/model-transparency-cli-rhel9, rhtas/model-validation-agent-rhel9, rhtas/model-validation-rhel9-operator
    affected: no fix available
  • Red Hat Zero Trust Workload Identity Manager - Tech Preview zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9, zero-trust-workload-identity-manager/spiffe-spire-server-rhel9, zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9, zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9
    affected: no fix planned “Will not fix”
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1787593946, cluster-observability-operator/thanos-rhel9 1790854526, cluster-observability-operator/prometheus-rhel9 1787593705, cluster-observability-operator/alertmanager-rhel9 1787593799, cluster-observability-operator/cluster-health-analyzer-rhel9 1787594138, cluster-observability-operator/obo-prometheus-rhel9-operator 1787593671, +3 more
    fixed: vendor fix RHSA-2026:61314
  • Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-storage-rhel9 4.2.0-22, cryostat/cryostat-rhel9-operator 4.2.0-21
    fixed: vendor fix RHSA-2026:68333
  • Red Hat DevWorkspace Operator 1.0 devworkspace/devworkspace-rhel9-operator 1791368665
    fixed: vendor fix RHSA-2026:85247
  • Red Hat external secrets operator for Red Hat OpenShift 1.2 external-secrets-operator/external-secrets-rhel9 1788963929
    fixed: vendor fix RHSA-2026:66363
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.0 openshift-logging/logging-loki-rhel9 1791500729, openshift-logging/loki-rhel9-operator 1791499216, openshift-logging/lokistack-gateway-rhel9 1791500864
    fixed: vendor fix RHSA-2026:83013

52 more fixed, 78 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/baggage
>=1.41.0, <1.42.0
>=1.43.0, <1.44.0
1.42.0
1.44.0
go go.opentelemetry.io/otel/propagation
>=1.41.0, <1.42.0
>=1.43.0, <1.44.0
1.42.0
1.44.0
go go.opentelemetry.io/otel
>=1.41.0, <1.42.0
>=1.43.0, <1.44.0
1.42.0
1.44.0

Affected products

  • open-telemetry go.opentelemetry.io/otel/baggage
  • open-telemetry go.opentelemetry.io/otel/propagation

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.