{"schemaVersion":3,"id":"CVE-2026-48504","aliases":["CGA-2hxg-jg96-q67m","CGA-46h7-5rx6-2g68","CGA-7434-p347-cjvh","CGA-8vxr-2mg7-p2q7","CGA-9g3q-7pv4-x4fc","CGA-c3wv-pfrr-27v5","CGA-f4wp-ff5g-5gwr","CGA-g3xc-8c8f-9m23","CGA-gxr2-hvvx-w36w","CGA-m7jf-5fj3-fxw6","CGA-mgj8-mc7m-hv7x","CGA-mjhf-4wvm-prvg","CGA-mwfc-jhfr-jwpv","CGA-qxrh-5xvq-mvc9","CGA-r9p4-8fmj-x64j","CGA-rjfv-f5gc-wr75","CGA-rjvf-jmmp-h72j","CGA-wccw-qq8x-7m5j","CGA-2wr4-49hq-32j2","CGA-5m5w-45w4-2v79","CGA-5wg8-6485-3hh2","CGA-68mg-7rhf-m9p8","CGA-6cv6-mcjv-4x2c","CGA-6rph-x39f-5m84","CGA-7m7j-h9p2-q74m","CGA-94rc-g5qh-43c4","CGA-chc3-q5gh-97hg","CGA-g8h5-q7r8-p8h4","CGA-hq7r-pmf4-rr48","CGA-hwhg-m44g-fp8w","GHSA-w9wp-h8wv-79jx","CGA-qm9c-7jfr-6gww","CGA-r628-r858-g2p7","CGA-r9cf-pq53-qwvj","CGA-v2wr-v54j-m49c"],"status":"published","duplicateOf":null,"title":null,"description":"OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.","dates":{"published":"2026-07-17T20:13:45.686Z","modified":"2026-07-20T15:18:22.372Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Crates.io","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":10,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00418,"percentile":0.34713,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00418},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00418,"percentile":0.34713}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00418,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00418,"percentile":0.34713}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"apollo-router-2","name":"apollo-router-2","label":"apollo-router-2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apollo-router-2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"apollo-router-2.10","name":"apollo-router-2.10","label":"apollo-router-2.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/apollo-router-2.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"codex","name":"codex","label":"codex","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/codex","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-lambda-extension","name":"datadog-lambda-extension","label":"datadog-lambda-extension","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-lambda-extension","purlType":"apk","versions":[{"text":"< 101-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 101-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"datadog-lambda-extension-fips","name":"datadog-lambda-extension-fips","label":"datadog-lambda-extension-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/datadog-lambda-extension-fips","purlType":"apk","versions":[{"text":"< 101-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 101-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"deno","name":"deno","label":"deno","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/deno","purlType":"apk","versions":[{"text":"< 2.9.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.2-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"komodo-cli","name":"komodo-cli","label":"komodo-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/komodo-cli","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"komodo-core","name":"komodo-core","label":"komodo-core","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/komodo-core","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"komodo-periphery","name":"komodo-periphery","label":"komodo-periphery","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/komodo-periphery","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"libquiche","name":"libquiche","label":"libquiche","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/libquiche","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"linkerd2-proxy","name":"linkerd2-proxy","label":"linkerd2-proxy","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/linkerd2-proxy","purlType":"apk","versions":[{"text":"< 2.362.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.362.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"mountpoint-s3","name":"mountpoint-s3","label":"mountpoint-s3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/mountpoint-s3","purlType":"apk","versions":[{"text":"< 1.22.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.3-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"parseable","name":"parseable","label":"parseable","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/parseable","purlType":"apk","versions":[{"text":"< 2.9.4-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.4-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"quiche","name":"quiche","label":"quiche","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/quiche","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wadm","name":"wadm","label":"wadm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wadm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wasmcloud","name":"wasmcloud","label":"wasmcloud","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wasmcloud","purlType":"apk","versions":[{"text":"< 2.5.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"deno","name":"deno","label":"deno","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/deno","purlType":"apk","versions":[{"text":"< 2.9.2-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.2-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"libquiche","name":"libquiche","label":"libquiche","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/libquiche","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"linkerd2-proxy","name":"linkerd2-proxy","label":"linkerd2-proxy","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/linkerd2-proxy","purlType":"apk","versions":[{"text":"< 2.362.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.362.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"mountpoint-s3","name":"mountpoint-s3","label":"mountpoint-s3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/mountpoint-s3","purlType":"apk","versions":[{"text":"< 1.22.3-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.3-r6","eol":null,"hubHref":null},{"vendor":"wolfi","product":"parseable","name":"parseable","label":"parseable","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/parseable","purlType":"apk","versions":[{"text":"< 2.9.4-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.9.4-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"quiche","name":"quiche","label":"quiche","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/quiche","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"wadm","name":"wadm","label":"wadm","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/wadm","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"wasmcloud","name":"wasmcloud","label":"wasmcloud","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/wasmcloud","purlType":"apk","versions":[{"text":"< 2.5.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.5.2-r1","eol":null,"hubHref":null},{"vendor":"Crates.Io","product":"opentelemetry_sdk","name":"opentelemetry_sdk","label":"opentelemetry_sdk","ecosystem":"Crates.Io","cpePart":null,"purl":"pkg:cargo/opentelemetry_sdk","purlType":"cargo","versions":[{"text":"< 0.32.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.32.1","eol":null,"hubHref":null},{"vendor":"open-telemetry","product":"opentelemetry-rust","name":"opentelemetry-rust","label":"opentelemetry-rust","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 0.32.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.32.1","eol":null,"hubHref":"/vendor/open-telemetry/opentelemetry-rust"}],"affectedCount":26,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx","label":"github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB"]},{"url":"https://github.com/open-telemetry/opentelemetry-rust/commit/a389ca6b3e416416bc8fc9b01cf6076b9182ed14","label":"github.com/open-telemetry/opentelemetry-rust/commit/a389ca6b3e416416bc8fc9b01cf6076b9182ed14","hostname":"github.com","tags":["X Refsource MISC","FIX"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48504.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48504.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48504","label":"nvd.nist.gov/vuln/detail/CVE-2026-48504","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/open-telemetry/opentelemetry-rust","label":"github.com/open-telemetry/opentelemetry-rust","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":["CGA-74HG-J64J-PGRR"]},"timeline":[{"kind":"published","date":"2026-07-17T20:13:45.686Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-20T15:18:22.372Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":21,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T13:35:06.046Z","stale":false,"partial":false}}