6 matches found
CVE-2026-128086
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...
OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
Summary OpenTelemetry Go eagerly materializes W3C baggage metadata into property objects during parsing. Slice growth, serialization, and copying into the internal representation cause bounded but disproportionate memory-allocation amplification for a valid, densely populated header. In v1.46.0 a...
GHSA-RRFC-GJM9-CGRJ OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
Summary OpenTelemetry Go eagerly materializes W3C baggage metadata into property objects during parsing. Slice growth, serialization, and copying into the internal representation cause bounded but disproportionate memory-allocation amplification for a valid, densely populated header. In v1.46.0 a...
CVE-2026-128086 OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...
CVE-2026-128086 OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...
CVE-2026-128086
The OpenTelemetry-Go Go implementation (go.opentelemetry.io/otel) contains a vulnerability where baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property. This behavior causes bounded but disproportionate memory-allocation amplification when processing valid, d...