CVE-2026-128086

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...

CVE-2026-128086 OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...

CVE-2026-128086

The OpenTelemetry-Go Go implementation (go.opentelemetry.io/otel) contains a vulnerability where baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property. This behavior causes bounded but disproportionate memory-allocation amplification when processing valid, d...