telemetry/opentelemetry: Denial of Service via Oversized Baggage Header Parsing

Exploitable under specific conditions

This CVE can affect KrakenD under specific conditions. Review the affected versions below and upgrade if your deployment is exposed.

Only reachable when the telemetry/opentelemetry component is enabled and configured to propagate W3C baggage headers. Deployments without OpenTelemetry tracing enabled are not exposed.

Component

OpenTelemetry-Go (baggage propagation)

Disclosed

Aug 14, 2026

CVSS Score

5.3

Description

OpenTelemetry-Go’s baggage.Parse function removed its raw-length rejection check in versions 1.41.0 and 1.43.0, allowing it to process arbitrarily large or malformed W3C baggage HTTP headers instead of rejecting them outright. A client sending an oversized baggage header can force excessive CPU and memory use while the header is parsed and logged as an error, resulting in a denial of service. The fix restores the length check in versions 1.42.0 and 1.44.0.

Version summary

Community Edition

2.13.9

addresses this CVE

Affected CE versions

>= 2.0, < 2.13.9

Enterprise Edition

2.13.7

addresses this CVE

Affected EE versions

>= 2.0, < 2.13.7

Upgrade to the addressed version or later to remediate this vulnerability.

References

View CVE-2026-41178 on NVD

Stay up to date with KrakenD releases and important updates