CVE-2026-48504: Allocation of Resources Without Limits or Throttling

OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extractwithcontext in opentelemetrysdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work an...

a3s-cron (0.1.2), a3s-lane (>=0.2.0, <=0.4.0) +178 more potentially affected by CVE-2026-48504 via opentelemetry_sdk (>=0.18.0, <=0.31.0)

opentelemetrysdk CARGO version =0.18.0, =0.2.0, =0.1.0, =0.0.1, =0.8.1, =0.3.0, =4.0.15, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.8.1 and more Source cves: CVE-2026-48504 Source advisory: OSV:GHSA-W9WP-H8WV-79JX...