CVE-2026-41178
CVE
Medium
· CVSS 5.3
Medium Impacttelemetry/opentelemetry: Denial of Service via Oversized Baggage Header Parsing
Exploitable under specific conditions
This vulnerability can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.
Only reachable when the
telemetry/opentelemetry component is enabled and configured
to propagate W3C baggage headers. Deployments without OpenTelemetry tracing enabled
are not exposed.Component
OpenTelemetry-Go (baggage propagation)
Disclosed
Aug 14, 2026
CVSS Score
5.3
Description
OpenTelemetry-Go’s
baggage.Parse function removed its raw-length rejection check in
versions 1.41.0 and 1.43.0, allowing it to process arbitrarily large or malformed W3C
baggage HTTP headers instead of rejecting them outright. A client sending an
oversized baggage header can force excessive CPU and memory use while the header is
parsed and logged as an error, resulting in a denial of service. The fix restores the
length check in versions 1.42.0 and 1.44.0.Version summary
Community Edition
2.13.9
addresses this advisory
Affected CE versions
>= 2.0, < 2.13.9
Enterprise Edition
2.13.7
addresses this advisory
Affected EE versions
>= 2.0, < 2.13.7
Upgrade to the addressed version or later to remediate this vulnerability.