CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

[
  {
    "vendor": "open-telemetry",
    "product": "opentelemetry-java",
    "versions": [
      {
        "version": "< 1.62.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "io.opentelemetry",
    "product": "opentelemetry-api",
    "versions": [
      {
        "version": "1.62.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "io.opentelemetry",
    "product": "opentelemetry-extension-trace-propagators",
    "versions": [
      {
        "version": "1.62.0",
        "status": "affected"
      }
    ]
  }
]