CVE-2026-41178: OpenTelemetry-Go's baggage parsing no longer caps raw header length

Analyzed

AliasesSUSE-SU-2026:23619-1SUSE-SU-2026:3883-1SUSE-SU-2026:3928-1+5895 more

Published 04-06-2026Last modified 04-06-2026

Vulnerability summary

CVE-2026-41178 is a medium (CVSS 5.3) vulnerability in open-telemetry go.opentelemetry.io/otel/baggage. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 27% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.34%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 67 · Related 54

OPENSUSE-SU-2026:11667-1 OPENSUSE-SU-2026:11670-1 OPENSUSE-SU-2026:11676-1 OPENSUSE-SU-2026:11684-1 OPENSUSE-SU-2026:11731-1 OPENSUSE-SU-2026:11732-1+62 more

Timeline

04-06-2026
PublishedVulnerability first disclosed.
04-06-2026
Last modifiedVulnerability information updated.

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

CVSS metrics

8 scores · 8 sources · 1 version

v3.15.3

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.34% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r57
act< 0.2.89-r2
addon-resizer< 1.8.23-r23
addon-resizer-fips< 1.8.23-r24
agentbeat< 9.2.7-r15

agentbeat-fips< 9.2.7-r14
amazon-cloudwatch-agent< 1.300070.0-r2 | < 1.300073.0-r1
amazon-cloudwatch-agent-fips< 1.300070.0-r4
amazon-cloudwatch-agent-operator< 3.5.0-r4
amazon-cloudwatch-agent-operator-fips< 3.5.0-r3
amazon-eks-ami< 20260618-r1
amazon-eks-ami-fips< 20260618-r1
ansible-operator< 1.42.3-r2
ansible-operator-fips< 1.42.2-r12
apisix-ingress-controller< 2.1.0-r5
apm-server-8.19< 8.19.17-r1
apm-server-9.1All versions (No fix recorded)
apm-server-9.2< 9.2.8-r13 | < 9.2.8-r12
apm-server-fips-9.1All versions (No fix recorded)
apm-server-fips-9.2< 9.2.8-r13
apply-cve-bump< 0.2.289-r1
argo-cd-3.0All versions (No fix recorded)
argo-cd-3.0-compatAll versions (No fix recorded)
argo-cd-3.1< 3.1.16-r12
argo-cd-3.1-compat< 3.1.16-r12
argo-cd-3.2< 3.2.12-r4
argo-cd-3.2-compat< 3.2.12-r4
argo-cd-3.3< 3.3.12-r1
argo-cd-3.3-compatAll versions (No fix recorded) | < 3.3.12-r1
argo-cd-3.4< 3.4.4-r1
argo-cd-3.4-compat< 3.4.4-r1
argo-cd-fips-3.0All versions (No fix recorded)
argo-cd-fips-3.0-compatAll versions (No fix recorded)
argo-cd-fips-3.1All versions (No fix recorded)
argo-cd-fips-3.1-compatAll versions (No fix recorded)
argo-cd-fips-3.2< 3.2.12-r8
argo-cd-fips-3.2-compat< 3.2.12-r8
argo-cd-fips-3.3< 3.3.12-r2
argo-cd-fips-3.3-compat< 3.3.12-r2
argo-cd-fips-3.4< 3.4.4-r1
argo-cd-fips-3.4-compat< 3.4.4-r1
argo-events< 1.9.11-r0
argo-events-fips< 1.9.11-r0
argo-rollouts< 1.9.0-r18
argo-rollouts-fips< 1.9.0-r13
argo-workflow-controller-3.6All versions (No fix recorded)
argo-workflow-controller-3.7< 3.7.15-r3
argo-workflow-controller-4.0< 4.0.6-r2
argo-workflow-controller-fips-3.6All versions (No fix recorded)
argo-workflow-controller-fips-3.7< 3.7.15-r2
argo-workflow-controller-fips-4.0< 4.0.6-r2
argo-workflow-executor-3.6All versions (No fix recorded)
argo-workflow-executor-3.7< 3.7.15-r3
argo-workflow-executor-4.0< 4.0.6-r2
argo-workflow-executor-fips-3.6All versions (No fix recorded)
argo-workflow-executor-fips-3.7< 3.7.15-r2
argo-workflow-executor-fips-4.0< 4.0.6-r2
argo-workflows-3.6All versions (No fix recorded)
argo-workflows-3.7< 3.7.15-r3
argo-workflows-4.0< 4.0.6-r2
argo-workflows-fips-3.6All versions (No fix recorded)
argo-workflows-fips-3.7< 3.7.15-r2
argo-workflows-fips-4.0< 4.0.6-r2
argo-workflows-ui-4.0< 4.0.11-r0
argocd-image-updater< 1.2.2-r1
argocd-image-updater-fips< 1.2.2-r2
art< 0.2.289-r1
atlas-1.0< 1.0.0-r11
atlas-1.0-fips< 1.0.0-r8
atlas-1.1< 1.1.0-r9
atlas-1.1-fips< 1.1.0-r12
atlas-1.2< 1.2.3-r1
auditbeat-8.17< 8.17.10-r27
auditbeat-9.0< 9.0.8-r24
auditbeat-9.1< 9.1.10-r18
auditbeat-9.2< 9.2.8-r15
auditbeat-9.3< 9.3.5-r5
auditbeat-fips-8.17< 8.17.10-r24
auditbeat-fips-9.0< 9.0.8-r27
auditbeat-fips-9.1< 9.1.10-r20
auditbeat-fips-9.2< 9.2.8-r14
authentik-2025.12-go-server< 2025.12.6-r15
authentik-2026.2-go-server< 2026.2.4-r12
authentik-2026.5-go-server< 2026.5.3-r3
authentik-fips-2025.12-go-server< 2025.12.6-r15
authentik-fips-2026.2-go-server< 2026.2.6-r3
authentik-fips-2026.5-go-server< 2026.5.3-r2
aws-ebs-csi-driver-1.50All versions (No fix recorded)
aws-ebs-csi-driver-1.51< 1.51.2-r17
aws-ebs-csi-driver-1.52All versions (No fix recorded)
aws-ebs-csi-driver-1.53< 1.53.0-r15
aws-ebs-csi-driver-1.54< 1.54.0-r16
aws-ebs-csi-driver-1.55< 1.55.0-r11
aws-ebs-csi-driver-1.56< 1.56.0-r13
aws-ebs-csi-driver-1.57< 1.57.1-r8
aws-ebs-csi-driver-1.58All versions (No fix recorded)
aws-ebs-csi-driver-1.59< 1.59.0-r6
aws-ebs-csi-driver-1.60< 1.60.1-r6
aws-ebs-csi-driver-fips-1.50< 1.50.3-r16
aws-ebs-csi-driver-fips-1.51< 1.51.2-r16
aws-ebs-csi-driver-fips-1.52< 1.52.1-r16
aws-ebs-csi-driver-fips-1.53< 1.53.0-r13
aws-ebs-csi-driver-fips-1.54< 1.54.0-r14
aws-ebs-csi-driver-fips-1.55All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.57< 1.57.1-r7
aws-ebs-csi-driver-fips-1.58< 1.58.0-r8
aws-ebs-csi-driver-fips-1.59< 1.59.0-r7
aws-efs-csi-driver< 3.3.0-r2
aws-efs-csi-driver-fipsAll versions (No fix recorded)
aws-fsx-csi-driver< 1.9.0-r7
aws-fsx-csi-driver-fips< 1.9.0-r10
aws-iam-authenticator< 0.7.18-r1
aws-iam-authenticator-fips< 0.7.18-r2
aws-node-termination-handler< 1.25.6-r12
aws-node-termination-handler-fips< 1.25.6-r9
aws-otel-collector< 0.48.0-r6
aws-otel-collector-fips< 0.48.0-r4
azure-service-operator< 2.20.0-r1
azure-service-operator-fips< 2.19.0-r6
azure-workload-identity-webhook< 1.6.0-r2
azuredisk-csi-1.32All versions (No fix recorded)
azuredisk-csi-1.33< 1.33.12-r0
azuredisk-csi-1.34< 1.34.4-r5
azuredisk-csi-fips-1.32All versions (No fix recorded)
azuredisk-csi-fips-1.33< 1.33.12-r0
azuredisk-csi-fips-1.34< 1.34.4-r4
azurefile-csi-1.32All versions (No fix recorded)
azurefile-csi-1.33< 1.33.10-r11
azurefile-csi-1.34< 1.34.6-r5
azurefile-csi-1.35< 1.35.4-r1
azurefile-csi-fips-1.32All versions (No fix recorded)
azurefile-csi-fips-1.33< 1.33.10-r11
azurefile-csi-fips-1.34< 1.34.6-r5
azurefile-csi-fips-1.35< 1.35.4-r1
backup-restore-operator-10.0< 10.0.5-r1
backup-restore-operator-7.0< 7.0.8-r1
backup-restore-operator-8.1< 8.1.5-r1
backup-restore-operator-9.0< 9.0.5-r1
backup-restore-operator-fips-10.0< 10.0.5-r1
backup-restore-operator-fips-7.0< 7.0.7-r1
backup-restore-operator-fips-8.1< 8.1.5-r1
backup-restore-operator-fips-9.0< 9.0.5-r1
bank-vaults< 1.33.1-r4
bank-vaults-fips< 1.33.1-r2
bank-vaults-templateAll versions (No fix recorded) | < 1.33.2-r3 | < 1.33.1-r4
bank-vaults-template-fips< 1.33.1-r2
bank-vaults-vault-operator< 1.24.0-r3
blob-csi-1.23All versions (No fix recorded)
blob-csi-1.24< 1.24.11-r25
blob-csi-1.25< 1.25.10-r21
blob-csi-1.26< 1.26.14-r1
blob-csi-1.27< 1.27.7-r1 | All versions (No fix recorded) | < 1.27.10-r0
blob-csi-fips-1.23< 1.23.11-r78
blob-csi-fips-1.24All versions (No fix recorded)
blob-csi-fips-1.25< 1.25.10-r22
blob-csi-fips-1.26< 1.26.14-r1
blob-csi-fips-1.27< 1.27.7-r1
boring-registry< 0.18.0-r2
boring-registry-fips< 0.18.0-r1
buildah< 1.44.0-r5
buildah-fips< 1.44.0-r4
caddy< 2.11.4-r3
caddy-fips< 2.11.4-r3
cadence-fips-server< 1.4.1-r2
cadence-server< 1.4.1-r2
cadvisor< 0.60.1-r2
cadvisor-compat< 0.60.5-r8
cadvisor-fips< 0.60.1-r2
calico-apiserver-3.30All versions (No fix recorded)
calico-apiserver-3.31< 3.31.6-r9
calico-apiserver-3.32< 3.32.1-r1
calico-apiserver-fips-3.30< 3.30.7-r19
calico-apiserver-fips-3.31< 3.31.6-r3
calico-apiserver-fips-3.32< 3.32.1-r1
calico-app-policy-3.30All versions (No fix recorded)
calico-app-policy-3.31All versions (No fix recorded)
calico-app-policy-3.32< 3.32.1-r1
calico-app-policy-fips-3.30< 3.30.7-r19
calico-app-policy-fips-3.31< 3.31.6-r3
calico-app-policy-fips-3.32< 3.32.1-r1
calico-cni-3.32< 3.32.1-r1
calico-cni-fips-3.32< 3.32.1-r1
calico-felix-3.30All versions (No fix recorded)
calico-felix-3.31All versions (No fix recorded)
calico-felix-3.32< 3.32.2-r3 | All versions (No fix recorded) | < 3.32.1-r1
calico-felix-fips-3.30< 3.30.7-r19
calico-felix-fips-3.31< 3.31.6-r3
calico-felix-fips-3.32< 3.32.1-r1
calico-goldmane-3.30All versions (No fix recorded)
calico-goldmane-3.31All versions (No fix recorded)
calico-goldmane-3.32All versions (No fix recorded) | < 3.32.2-r3 | < 3.32.1-r1
calico-goldmane-fips-3.30< 3.30.7-r19
calico-goldmane-fips-3.31< 3.31.6-r3
calico-goldmane-fips-3.32< 3.32.1-r1
calico-key-cert-provisioner-3.32< 3.32.2-r3
calico-kube-controllers-3.30All versions (No fix recorded)
calico-kube-controllers-3.31All versions (No fix recorded)
calico-kube-controllers-3.32< 3.32.1-r1
calico-kube-controllers-fips-3.30< 3.30.7-r19
calico-kube-controllers-fips-3.31< 3.31.6-r3

Show all 200

1 vendor · 200 products · Showing 200 of 3264

References

20 links

github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835X Refsource CONFIRMARTICLEREPORTAdvisoryWEBIssue TrackingPatchVendor Advisory
github.com/open-telemetry/opentelemetry-go/pull/7880X Refsource MISCARTICLEREPORTFIXWEBIssue TrackingPatch
www.suse.com/support/update/announcement/2026/suse-su-202623619-1/Advisory
bugzilla.suse.com/1276667REPORT
www.suse.com/security/cve/CVE-2026-41178WEB
www.suse.com/support/update/announcement/2026/suse-su-20263883-1/Advisory
www.suse.com/support/update/announcement/2026/suse-su-20263928-1/Advisory
bugzilla.suse.com/1276731REPORT
access.redhat.com/errata/RHSA-2026:68550Advisory
access.redhat.com/security/updates/classification/ARTICLE

Show all 20 references

bugzilla.redhat.com/show_bug.cgi?id=2484830REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_68550.jsonAdvisory
access.redhat.com/security/cve/CVE-2026-41178REPORT
www.cve.org/CVERecord?id=CVE-2026-41178AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2026-41178Advisory
ubuntu.com/security/CVE-2026-41178REPORT
security-tracker.debian.org/tracker/CVE-2026-41178Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41178.jsonAdvisory
github.com/open-telemetry/opentelemetry-goPACKAGE
bugzilla.suse.com/1276712REPORT