CVE-2026-54285 Details
Description
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.
A vulnerability exists in the OpenTelemetry JavaScript Client, specifically in the W3CBaggagePropagator.extract() method of the @opentelemetry/core package, prior to version 2.8.0. The issue arises because the method does not impose size limits when parsing inbound baggage HTTP headers. While the W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries, these limits were only applied when injecting headers, not when extracting them. As a result, parsing oversized baggage can lead to unbounded memory allocation, proportional to the header size, without any safeguards.
Users are advised to update the @opentelemetry/core package to version 2.8.0 or later. The updated version enforces baggage size limits in accordance with the W3C Baggage specification, truncating headers that exceed the maximum allowed sizes. For non-HTTP transports receiving baggage from untrusted sources, validate input sizes before passing them to the propagator.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf | [email protected] | Vendor AdvisoryMitigation |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry | < 2.8.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 27, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |