CVE-2026-48504 Details
Description
OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.
A vulnerability in OpenTelemetry Rust's SDK component, specifically in versions through 0.32.0, allows for unbounded memory allocation when processing W3C Baggage headers. The issue arises because the BaggagePropagator::extract_with_context method did not apply W3C Baggage size restrictions before parsing inbound headers. As a result, a large, attacker-controlled header could generate unnecessary CPU load and temporary heap allocations while the SDK parsed entries that would ultimately be discarded due to storage limits. This vulnerability can lead to increased resource usage per request, potentially contributing to denial-of-service conditions, especially in the absence of application or transport-level header size limits.
Upgrade OpenTelemetry Rust SDK to version 0.32.1 or later. Version 0.32.1 applies the W3C Baggage limits by rejecting headers over 8192 bytes and capping the extraction to the first 64 list members.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |