CVE-2026-116694
Received Received - Intake

OpenTelemetry Python JaegerPropagator Denial of Service

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: GitHub, Inc.

Description
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116694
EUVD
EUVD-2026-111385

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
open-telemetry opentelemetry-python < 1.45.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenTelemetry Python's JaegerPropagator.extract() function in versions before 1.45.0. It allows untrusted input to cause unnecessary CPU usage and memory allocations by processing numerous or oversized uberctx-* baggage values without proper size limits.

Impact Analysis

If you use OpenTelemetry Python with the Jaeger propagator enabled, an attacker could send specially crafted requests to consume excessive CPU and memory, potentially causing a denial of service. The impact is reduced if default HTTP server limits are in place.

Mitigation Strategies

Upgrade OpenTelemetry Python to version 1.45.0 or later to address the issue in JaegerPropagator.extract().

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116694. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart