{"id":"CVE-2026-48504","summary":"OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation","details":"OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.","aliases":["GHSA-w9wp-h8wv-79jx"],"modified":"2026-07-22T05:29:47.510209719Z","published":"2026-07-17T20:13:45.686Z","related":["CGA-74hg-j64j-pgrr"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48504.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48504.json"},{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48504"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-rust/commit/a389ca6b3e416416bc8fc9b01cf6076b9182ed14"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-telemetry/opentelemetry-rust","events":[{"introduced":"0"},{"fixed":"a389ca6b3e416416bc8fc9b01cf6076b9182ed14"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"0.32.1"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["opentelemetry_sdk-0.32.0","opentelemetry-zipkin-0.32.0","opentelemetry-stdout-0.32.0","opentelemetry-semantic-conventions-0.32.0","opentelemetry-proto-0.32.0","opentelemetry-prometheus-0.32.0","opentelemetry-otlp-0.32.0","opentelemetry-jaeger-propagator-0.32.0","opentelemetry-http-0.32.0","opentelemetry-appender-tracing-0.32.0","opentelemetry-appender-log-0.32.0","opentelemetry-0.32.0","v0.31.0","opentelemetry-prometheus-0.31.0","opentelemetry_sdk-0.30.0","opentelemetry-zipkin-0.30.0","opentelemetry-stdout-0.30.0","opentelemetry-semantic-conventions-0.30.0","opentelemetry-proto-0.30.0","opentelemetry-otlp-0.30.0","opentelemetry-jaeger-propagator-0.30.0","opentelemetry-http-0.30.0","opentelemetry-appender-tracing-0.30.0","opentelemetry-appender-log-0.30.0","opentelemetry-0.30.0","opentelemetry-prometheus-0.29.1","opentelemetry_sdk-0.29.0","opentelemetry-zipkin-0.29.0","opentelemetry-stdout-0.29.0","opentelemetry-semantic-conventions-0.29.0","opentelemetry-proto-0.29.0","opentelemetry-otlp-0.29.0","opentelemetry-jaeger-propagator-0.29.0","opentelemetry-http-0.29.0","opentelemetry-appender-log-0.29.0","opentelemetry-0.29.0","opentelemetry-appender-tracing-0.29.1","opentelemetry-prometheus-0.29.0","opentelemetry-appender-tracing-0.28.1","opentelemetry-prometheus-0.28.0","opentelemetry_sdk-0.28.0","opentelemetry-zipkin-0.28.0","opentelemetry-stdout-0.28.0","opentelemetry-semantic-conventions-0.28.0","opentelemetry-proto-0.28.0","opentelemetry-otlp-0.28.0","opentelemetry-jaeger-propagator-0.28.0","opentelemetry-http-0.28.0","opentelemetry-appender-tracing-0.28.0","opentelemetry-appender-log-0.28.0","opentelemetry-0.28.0","opentelemetry-prometheus-0.27.0","opentelemetry_sdk-0.27.1","opentelemetry-0.27.1","opentelemetry-appender-log-0.27.0","opentelemetry_sdk-0.27.0","opentelemetry-zipkin-0.27.0","opentelemetry-stdout-0.27.0","opentelemetry-semantic-conventions-0.27.0","opentelemetry-proto-0.27.0","opentelemetry-otlp-0.27.0","opentelemetry-jaeger-propagator-0.27.0","opentelemetry-http-0.27.0","opentelemetry-appender-tracing-0.27.0","opentelemetry-0.27.0","v0.26.1","opentelemetry-proto-0.26.1","opentelemetry_sdk-0.26.0","opentelemetry-zipkin-0.26.0","opentelemetry-stdout-0.26.0","opentelemetry-semantic-conventions-0.26.0","opentelemetry-proto-0.26.0","opentelemetry-otlp-0.26.0","opentelemetry-jaeger-propagator-0.26.0","opentelemetry-http-0.26.0","opentelemetry-appender-tracing-0.26.0","opentelemetry-appender-log-0.26.0","opentelemetry-0.26.0","opentelemetry_sdk-0.25.0","opentelemetry-zipkin-0.25.0","opentelemetry-stdout-0.25.0","opentelemetry-semantic-conventions-0.25.0","opentelemetry-proto-0.25.0","opentelemetry-otlp-0.25.0","opentelemetry-jaeger-propagator-0.25.0","opentelemetry-http-0.25.0","opentelemetry-appender-tracing-0.25.0","opentelemetry-appender-log-0.25.0","opentelemetry-0.25.0","opentelemetry-prometheus-0.17.0","v0.24.1","opentelemetry_sdk-0.24.1","opentelemetry_sdk-0.24.0","opentelemetry-zipkin-0.22.0","opentelemetry-stdout-0.5.0","opentelemetry-semantic-conventions-0.16.0","opentelemetry-proto-0.7.0","opentelemetry-otlp-0.17.0","opentelemetry-jaeger-propagator-0.3.0","opentelemetry-http-0.13.0","opentelemetry-appender-tracing-0.5.0","opentelemetry-appender-log-0.5.0","opentelemetry-0.24.0","opentelemetry-zipkin-0.21.0","opentelemetry-stdout-0.4.0","opentelemetry-semantic-conventions-0.15.0","opentelemetry-sdk-0.23.0","opentelemetry-proto-0.6.0","opentelemetry-prometheus-0.16.0","opentelemetry-otlp-0.16.0","opentelemetry-jaeger-propagator-0.2.0","opentelemetry-jaeger-0.22.0","opentelemetry-http-0.12.0","opentelemetry-appender-tracing-0.4.0","opentelemetry-appender-log-0.4.0","opentelemetry-0.23.0","opentelemetry-http-0.11.1","v0.22.1","v0.22.0","opentelemetry_sdk-0.22.0","opentelemetry-zipkin-0.20.0","opentelemetry-stdout-0.3.0","opentelemetry-semantic-conventions-0.14.0","opentelemetry-proto-0.5.0","opentelemetry-prometheus-0.15.0","opentelemetry-otlp-0.15.0","opentelemetry-jaeger-propagator-0.1.0","opentelemetry-jaeger-0.21.0","opentelemetry-http-0.11.0","opentelemetry-0.22.0","openetelemetry-appender-tracing-0.3.0","openetelemetry-appender-log-0.3.0","v0.21.0","opentelemetry_sdk-0.21.0","opentelemetry-zipkin-0.19.0","opentelemetry-stdout-0.2.0","opentelemetry-semantic-conventions-0.13.0","opentelemetry-proto-0.4.0","opentelemetry-prometheus-0.14.0","opentelemetry-otlp-0.14.0","opentelemetry-jaeger-0.20.0","opentelemetry-http-0.10.0","opentelemetry-contrib-0.13.0","openetelemetry-appender-tracing-0.2.0","openetelemetry-appender-log-0.2.0","v0.20.0","opentelemetry_sdk-0.20.0","opentelemetry-zipkin-0.18.0","opentelemetry-semantic-conventions-0.12.0","opentelemetry-proto-0.3.0","opentelemetry-prometheus-0.13.0","opentelemetry-otlp-0.13.0","opentelemetry-jaeger-0.19.0","opentelemetry-http-0.9.0","opentelemetry-contrib-0.12.0","opentelemetry-0.20.0","openetelemetry-appender-log-0.1.0","v0.19.0","opentelemetry-zipkin-0.17.0","opentelemetry-prometheus-0.12.0","opentelemetry-otlp-0.12.0","opentelemetry-jaeger-0.18.0","opentelemetry-http-0.8.0","opentelemetry-contrib-0.11.0","opentelemetry-0.19.0","v0.18.0","opentelemetry_sdk-0.18.0","opentelemetry-zipkin-0.16.0","opentelemetry-semantic-conventions-0.10.0","opentelemetry-prometheus-0.11.0","opentelemetry-otlp-0.11.0","opentelemetry-jaeger-0.17.0","opentelemetry-http-0.7.0","opentelemetry-contrib-0.10.0","opentelemetry-0.18.0","v0.17.0","opentelemetry-zipkin-0.15.0","opentelemetry-semantic-conventions-0.9.0","opentelemetry-prometheus-0.10.0","opentelemetry-otlp-0.10.0","opentelemetry-jaeger-0.16.0","opentelemetry-http-0.6.0","opentelemetry-contrib-0.9.0","opentelemetry-0.17.0","v0.16.0","opentelemetry-zipkin-0.14.0","opentelemetry-semantic-conventions-0.8.0","opentelemetry-prometheus-0.9.0","opentelemetry-otlp-0.9.0","opentelemetry-jaeger-0.15.0","opentelemetry-http-0.5.0","opentelemetry-contrib-0.8.0","opentelemetry-0.16.0","v0.15.0","opentelemetry-zipkin-0.13.0","opentelemetry-semantic-conventions-0.7.0","opentelemetry-prometheus-0.8.0","opentelemetry-otlp-0.8.0","opentelemetry-jaeger-0.14.0","opentelemetry-http-0.4.0","opentelemetry-contrib-0.7.0","opentelemetry-0.15.0","v0.14.0","opentelemetry-zipkin-0.12.0","opentelemetry-semantic-conventions-0.6.0","opentelemetry-prometheus-0.7.0","opentelemetry-otlp-0.7.0","opentelemetry-jaeger-0.13.0","opentelemetry-http-0.3.0","opentelemetry-contrib-0.6.0","opentelemetry-0.14.0","opentelemetry-jaeger-0.12.1","v0.13.0","opentelemetry-0.13.0","v0.12.0","opentelemetry-0.12.0","v0.11.2","opentelemetry-0.11.2","v0.11.1","opentelemetry-0.11.1","v0.11.0","opentelemetry-0.11.0","v0.10.0","opentelemetry-0.10.0","v0.9.1","opentelemetry-0.9.1","v0.9.0","opentelemetry-0.9.0","v0.8.0","opentelemetry-0.8.0","v0.7.0","opentelemetry-0.7.0","v0.6.0","opentelemetry-0.6.0","v0.5.0","opentelemetry-0.5.0","v0.4.0","opentelemetry-0.4.0","v0.3.0","opentelemetry-0.3.0","v0.2.0","opentelemetry-0.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48504.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}