be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-server-admin (>=2.10.0, <=3.4.0) +625 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (>=1.0.0, <=1.61.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version =1.0.0, =2.10.0, =3.6.0, =1.1.0, =2.10.0, =2.10.0, =2.10.0, =3.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.4.0 - br.com.sawcunhaos:scos-foundation-security 1.1.0 - ch.admin.bit.jeap:jeap-archrepo-dbschem...

CVE-2026-45292

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-server-admin (>=2.10.0, <=3.4.0) +741 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (>=0.7.0, <=1.61.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version =0.7.0, =2.10.0, =3.6.0, =1.1.0, =2.10.0, =2.10.0, =2.10.0, =3.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.4.0 - br.com.sawcunhaos:scos-foundation-security 1.1.0 - ch.admin.bit.jeap:jeap-archrepo-dbschem...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-server-admin (>=2.10.0, <=3.4.0) +625 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (>=1.0.0, <=1.61.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version =1.0.0, =2.10.0, =3.6.0, =1.1.0, =2.10.0, =2.10.0, =2.10.0, =3.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.4.0 - br.com.sawcunhaos:scos-foundation-security 1.1.0 - ch.admin.bit.jeap:jeap-archrepo-dbschem...

com.lightstep.opentelemetry:opentelemetry-launcher (0.7.1) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.7.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.lightstep.opentelemetry:opentelemetry-launcher (0.7.2) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.7.1)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.comcast.money:money-otel-formatters_2.12 (>=0.9.1-rc1, <=0.10.0), com.comcast.money:money-otel-formatters_2.13 (>=0.9.1-rc1, <=0.10.0) +1 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.10.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: - com.comcast.money:money-otel-formatters2.1...

com.lightstep.opentelemetry:opentelemetry-launcher (>=0.8.0, <=0.8.1) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.8.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.comcast.money:money-otel-formatters_2.12 (0.14.1), com.comcast.money:money-otel-formatters_2.13 (0.14.1) +8 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.14.1)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: - com.comcast.money:money-otel-formatters2.1...

com.lightstep.opentelemetry:opentelemetry-launcher (0.16.0), io.opentelemetry.javaagent:opentelemetry-javaagent-tooling (>=0.16.0, <=0.16.1) +1 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.16.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

io.opentelemetry.javaagent:opentelemetry-javaagent-tooling (0.17.0-alpha), io.opentelemetry:opentelemetry-opencensus-shim (0.17.0-alpha) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.17.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.lightstep.opentelemetry:opentelemetry-launcher (>=0.17.0, <=0.17.1), com.signalfx.public:otel-java-lambda-wrapper (0.0.4) +1 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.17.1)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.lightstep.opentelemetry:opentelemetry-launcher (0.9.0) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.9.1)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

io.opentelemetry.instrumentation:opentelemetry-aws-lambda-1.0 (>=0.15.0, <=0.15.1), io.opentelemetry.instrumentation:opentelemetry-aws-sdk-2.2 (>=0.15.0, <=0.15.1) +6 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.15.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.lightstep.opentelemetry:opentelemetry-launcher (0.11.0) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.11.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

io.opentelemetry:opentelemetry-opencensus-shim (0.14.0-alpha) potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.14.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

be.vlaanderen.informatievlaanderen.ldes.ldio:ldio-application (2.12.0), be.vlaanderen.informatievlaanderen.vsds:ldes-server-admin (>=2.10.0, <=3.4.0) +625 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (>=1.0.0, <=1.61.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version =1.0.0, =2.10.0, =3.6.0, =1.1.0, =2.10.0, =2.10.0, =2.10.0, =3.0.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =3.4.0 - br.com.sawcunhaos:scos-foundation-security 1.1.0 - ch.admin.bit.jeap:jeap-archrepo-dbschem...

com.lightstep.opentelemetry:opentelemetry-launcher (>=0.12.0, <=0.12.1), com.signalfx.public:otel-java-lambda-wrapper (0.0.1) +112 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.12.0)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

com.lightstep.opentelemetry:opentelemetry-launcher (>=0.13.0, <=0.13.1), io.opentelemetry.instrumentation:opentelemetry-aws-sdk-2.2 (>=0.13.0, <=0.13.1) +113 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-extension-trace-propagators (0.13.1)

io.opentelemetry:opentelemetry-extension-trace-propagators MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-extension-trace-propagators and may be impacted: -...

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

Summary The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service DoS in the consuming application. Details...