CVE-2026-116694 with a CVSS score of 6.3 is a resource exhaustion vulnerability in the OpenTelemetry Python Jaeger baggage propagation component, specifically in JaegerPropagator.extract() within opentelemetry-propagator-jaeger (pip) versions ≤ 1.44.0. The flaw is unbounded memory allocation and excessive processing when the propagator extracts inbound uberctx-* baggage headers without enforcing limits. An attacker can exploit it over the network by supplying untrusted propagation headers to a service that has the optional Jaeger propagator enabled and accepts inbound propagation data, without needing prior authentication or user interaction. The attack causes unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept, increasing per-request resource usage. Business impact is primarily availability degradation, because the issue can contribute to denial-of-service risk when transport-level limits are absent, weak, or configured above the baggage limits. The impact is limited to availability; it does not expose or modify telemetry data and does not allow code execution. The risk is generally lower for typical Python web deployments because the package must be installed separately and the Jaeger propagator is not enabled by default, but it is higher for non-HTTP transports, custom TextMapGetter implementations, or deployments where server and gateway header limits have been increased or disabled.
We recommend you to update opentelemetry-propagator-jaeger to version 1.45.0.[/subscribe_to_unlock_form]
CVE-2026-116694 with a CVSS score of 6.3 is a resource exhaustion vulnerability in the OpenTelemetry Python Jaeger baggage propagation component, specifically in JaegerPropagator.extract() within opentelemetry-propagator-jaeger (pip) versions ≤ 1.44.0. The flaw is unbounded memory allocation and excessive processing when the propagator extracts inbound uberctx-* baggage headers without enforcing limits. An attacker can exploit it over the network by supplying untrusted propagation headers to a service that has the optional Jaeger propagator enabled and accepts inbound propagation data, without needing prior authentication or user interaction. The attack causes unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept, increasing per-request resource usage. Business impact is primarily availability degradation, because the issue can contribute to denial-of-service risk when transport-level limits are absent, weak, or configured above the baggage limits. The impact is limited to availability; it does not expose or modify telemetry data and does not allow code execution. The risk is generally lower for typical Python web deployments because the package must be installed separately and the Jaeger propagator is not enabled by default, but it is higher for non-HTTP transports, custom TextMapGetter implementations, or deployments where server and gateway header limits have been increased or disabled.
We recommend you to update opentelemetry-propagator-jaeger to version 1.45.0.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]