Live › vulnerability › CVE-2026-116694
Go to dashboardThe Jaeger propagator in opentelemetry-propagator-jaeger did not limit how many inbound uberctx-* baggage headers it parsed. An attacker can send oversized baggage to cause extra CPU work and short-lived memory allocation, which can degrade availability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 21:09 UTC, 0h before NVD. All times on this page are UTC.
Only services that install the optional opentelemetry-propagator-jaeger package and enable JaegerPropagator to read inbound propagation headers are exposed. The default OpenTelemetry Python configuration does not enable it, and common web servers such as Gunicorn and Uvicorn limit header sizes before the propagator runs, which lowers the risk for typical HTTP deployments. Non-HTTP transports, custom TextMapGetter implementations, and servers with raised or disabled header limits deserve a closer look.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| opentelemetry-propagator-jaeger | pypi | <= 1.44.0 | 1.45.0 |
pip show opentelemetry-propagator-jaeger and check whether the version is 1.44.0 or earlier.JaegerPropagator or opentelemetry.propagators.jaeger to see whether the propagator is enabled.opentelemetry-propagator-jaeger to 1.45.0 or later, for example pip install --upgrade opentelemetry-propagator-jaeger>=1.45.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
JaegerPropagator.extract() in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx-* baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept.
Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits.
The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration.
Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom TextMapGetter implementations, or deployments where server and gateway limits have been increased or disabled.
The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution.
Versions of opentelemetry-propagator-jaeger earlier than 1.45.0 are affected.
Upgrade opentelemetry-propagator-jaeger to version 1.45.0 or later.
Version 1.45.0 limits extraction to 180 entries and 8,192 total bytes and skips entries larger than 4,096 bytes.
tonghuaroot
This page as .md · .json · in your agent: get_signal("CVE-2026-116694")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.