The-Agents-Epistemic-Baggage

The Agent's Epistemic Baggage An audit-oriented risk model for how agent-generated inferences can change epistemic status, gain operational authority, and influence later decisions through persistent memory. The problem An agentic AI system with writable persistent memory does not only retrieve...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

CVE-2026-116694

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

Linux Distros Unpatched Vulnerability : CVE-2026-116694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes...

DEBIAN-CVE-2026-116694

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

CVE-2026-116694

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

CVE-2026-116694

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

UBUNTU-CVE-2026-116694

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

GHSA-F5M9-JFRJ-JJJ7 OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

Summary JaegerPropagator.extract in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx- baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept...

CVE-2026-116694

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

EUVD-2026-111385

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

OpenTelemetry - CNCF OpenTelemetry Python resource management error vulnerability

OpenTelemetry: Versions prior to 1.45.0 of CNCF’s OpenTelemetry Python contain a resource management error vulnerability. This vulnerability arises because JaegerPropagator.extract fails to limit the number of entries, their size per entry, and the total size when processing incoming uberctx-...

PT-2026-127748

Summary JaegerPropagator.extract in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx- baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept...

CVE-2026-116694: Allocation of Resources Without Limits or Throttling

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract in opentelemetry-propagator-jaeger processes inbound uberctx- baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator c...

SUSE-SU-2026:24282-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

RHLW-2026-B13520FAC3AB7893 Lightwell Security Advisory: opentelemetry-api 1.25.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.25.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.25...

RHLW-2026-C5D9DDA1CBA52009 Lightwell Security Advisory: opentelemetry-api 1.28.0.rhlw-00002

Red Hat Lightwell has released io.opentelemetry:opentelemetry-api 1.28.0.rhlw-00002 with a backported security fix. CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation This patched artifact is a drop-in replacement for io.opentelemetry:opentelemetry-api 1.28...

openSUSE 16 Security Update : amazon-ecs-init (openSUSE-SU-2026:22035-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22035-1 advisory. - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs...

Security update for amazon-ecs-init (important)

openSUSE security update: security update for amazon-ecs-init ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22035-1 Rating: important References: bsc1276744 bsc1279231 bsc1279329 Cross-References: CVE-2026-41178 CVE-2026-84303 CVE-2026-84304 CVSS...

OPENSUSE-SU-2026:22035-1 Security update for amazon-ecs-init

This update for amazon-ecs-init fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276744. - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue...