CVE-2026-41178

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Trends

Current EPSS score: 0.34%• Percentile: 27%

Techniques & Countermeasures

• CWE-789•Memory Allocation with Excessive Size Value

  The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected Systems

• chainguard•aactl

  < 0.4.12-r57

• chainguard•act

  < 0.2.89-r2

• chainguard•addon-resizer

  < 1.8.23-r23

• chainguard•addon-resizer-fips

  < 1.8.23-r24

• chainguard•agentbeat

  < 9.2.7-r15

• chainguard•agentbeat-fips

  < 9.2.7-r14

• chainguard•amazon-cloudwatch-agent

  < 1.300070.0-r2 | < 1.300073.0-r1

• chainguard•amazon-cloudwatch-agent-fips

  < 1.300070.0-r4

• chainguard•amazon-cloudwatch-agent-operator

  < 3.5.0-r4

• chainguard•amazon-cloudwatch-agent-operator-fips

  < 3.5.0-r3

• chainguard•amazon-eks-ami

  < 20260618-r1

• chainguard•amazon-eks-ami-fips

  < 20260618-r1

• chainguard•ansible-operator

  < 1.42.3-r2

• chainguard•ansible-operator-fips

  < 1.42.2-r12

• chainguard•apisix-ingress-controller

  < 2.1.0-r5

• chainguard•apm-server-8.19

  < 8.19.17-r1

• chainguard•apm-server-9.1

  all

• chainguard•apm-server-9.2

  < 9.2.8-r13 | < 9.2.8-r12

• chainguard•apm-server-fips-9.1

  all

• chainguard•apm-server-fips-9.2

  < 9.2.8-r13

• chainguard•apply-cve-bump

  < 0.2.289-r1

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-3.1

  all

• chainguard•argo-cd-3.1-compat

  all

• chainguard•argo-cd-3.2

  < 3.2.12-r4

• chainguard•argo-cd-3.2-compat

  < 3.2.12-r4

• chainguard•argo-cd-3.3

  < 3.3.12-r1

• chainguard•argo-cd-3.3-compat

  < 3.3.12-r1 | < 0 | all

• chainguard•argo-cd-3.4

  < 3.4.4-r1

• chainguard•argo-cd-3.4-compat

  < 3.4.4-r1

• chainguard•argo-cd-fips-3.0

  all

• chainguard•argo-cd-fips-3.0-compat

  all

• chainguard•argo-cd-fips-3.1

  all

• chainguard•argo-cd-fips-3.1-compat

  all

• chainguard•argo-cd-fips-3.2

  < 3.2.12-r8

• chainguard•argo-cd-fips-3.2-compat

  < 3.2.12-r8

• chainguard•argo-cd-fips-3.3

  < 3.3.12-r2

• chainguard•argo-cd-fips-3.3-compat

  < 3.3.12-r2

• chainguard•argo-cd-fips-3.4

  < 3.4.4-r1

• chainguard•argo-cd-fips-3.4-compat

  < 3.4.4-r1

• chainguard•argo-events

  < 1.9.11-r0

• chainguard•argo-events-fips

  < 1.9.11-r0

• chainguard•argo-rollouts

  < 1.9.0-r18

• chainguard•argo-rollouts-fips

  < 1.9.0-r13

• chainguard•argo-workflow-controller-3.6

  all

• chainguard•argo-workflow-controller-3.7

  < 3.7.15-r3

• chainguard•argo-workflow-controller-4.0

  < 4.0.6-r2

• chainguard•argo-workflow-controller-fips-3.6

  all

• chainguard•argo-workflow-controller-fips-3.7

  < 3.7.15-r2

Showing first 50 affected entries in server-rendered view.

References (12)

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://github.com/open-telemetry/opentelemetry-go
• https://github.com/open-telemetry/opentelemetry-go/pull/7880
• https://nvd.nist.gov/vuln/detail/CVE-2026-41178
• https://security-tracker.debian.org/tracker/CVE-2026-41178
• https://www.suse.com/security/cve/CVE-2026-41178
• https://bugzilla.suse.com/1276712
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41178.json
• https://bugzilla.suse.com/1276667
• https://bugzilla.suse.com/1276731
• https://www.suse.com/support/update/announcement/2026/suse-su-20263883-1/
• https://www.suse.com/support/update/announcement/2026/suse-su-20263928-1/