CVE-2026-29181

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

CVSS Metrics

• v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.79%• Percentile: 55%

Techniques & Countermeasures

• CWE-770•Allocation of Resources Without Limits or Throttling

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

• chainguard•aactl

  < 0.4.12-r49

• chainguard•act

  < 0.2.87-r4

• chainguard•amazon-cloudwatch-agent-operator

  < 3.4.1-r1

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 3.4.1-r1

• chainguard•amazon-eks-ami

  < 20260318-r3

• chainguard•amazon-eks-ami-fips

  < 20260318-r3

• chainguard•argo-events

  < 1.9.10-r17

• chainguard•argo-events-fips

  < 1.9.10-r10

• chainguard•argo-rollouts

  < 1.9.0-r9

• chainguard•argo-rollouts-fips

  < 1.9.0-r6

• chainguard•argocd-image-updater

  < 1.1.1-r9

• chainguard•auditbeat-8.17

  < 8.17.10-r15

• chainguard•auditbeat-fips-8.17

  < 8.17.10-r14

• chainguard•authentik-2025.12-go-server

  < 2025.12.4-r7

• chainguard•authentik-2026.2-go-server

  < 2026.2.1-r7

• chainguard•authentik-fips-2025.12-go-server

  < 2025.12.4-r6

• chainguard•authentik-fips-2026.2-go-server

  < 2026.2.1-r6

• chainguard•aws-efs-csi-driver

  < 3.0.1-r1

• chainguard•aws-efs-csi-driver-fips

  < 3.0.1-r1

• chainguard•aws-privateca-issuer

  < 1.8.1-r2

• chainguard•aws-privateca-issuer-fips

  < 1.8.1-r2

• chainguard•azuredisk-csi-1.31

  all

• chainguard•azuredisk-csi-fips-1.31

  all

• chainguard•azurefile-csi-1.31

  all

• chainguard•azurefile-csi-1.32

  all

• chainguard•azurefile-csi-fips-1.31

  all

• chainguard•azurefile-csi-fips-1.32

  all

• chainguard•blob-csi-1.23

  < 1.23.11-r70

• chainguard•blob-csi-1.24

  < 1.24.11-r19

• chainguard•blob-csi-fips-1.23

  < 1.23.11-r72

• chainguard•blob-csi-fips-1.24

  < 1.24.11-r19

• chainguard•buildah

  < 1.43.1-r2

• chainguard•buildah-fips

  < 1.43.1-r3

• chainguard•cadence-fips-server

  < 1.4.1-r1

• chainguard•cadence-server

  < 1.4.1-r1

• chainguard•cadvisor

  < 0.56.2-r16

• chainguard•cadvisor-fips

  < 0.56.2-r7

• chainguard•cephcsi

  < 3.16.2-r4

• chainguard•cephcsi-fips

  < 3.16.2-r5

• chainguard•cert-manager-1.18

  all

• chainguard•cert-manager-acmesolver-1.18

  all

• chainguard•cert-manager-cainjector-1.18

  all

• chainguard•cert-manager-cmctl

  < 2.4.1-r7

• chainguard•cert-manager-cmctl-fips

  < 2.4.1-r8

• chainguard•cert-manager-controller-1.18

  all

• chainguard•cert-manager-google-cas-issuer

  < 0.11.0-r9

• chainguard•cert-manager-google-cas-issuer-fips

  < 0.11.0-r9

• chainguard•cert-manager-openshift-routes

  < 0.9.0-r3

• chainguard•cert-manager-openshift-routes-fips

  < 0.9.0-r3

• chainguard•cert-manager-startupapicheck-1.18

  all

Showing first 50 affected entries in server-rendered view.

References (15)

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
• https://github.com/open-telemetry/opentelemetry-go/pull/7880
• https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f
• https://github.com/open-telemetry/opentelemetry-go
• https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-29181
• https://access.redhat.com/security/cve/CVE-2026-29181
• https://bugzilla.redhat.com/show_bug.cgi?id=2456252
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json
• https://access.redhat.com/errata/RHSA-2026:25271
• https://access.redhat.com/errata/RHSA-2026:47735
• https://access.redhat.com/errata/RHSA-2026:61314
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29181.json
• https://access.redhat.com/errata/RHSA-2026:63140
• https://access.redhat.com/errata/RHSA-2026:66521