OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.45.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
OpenTelemetry Python's Jaeger propagator (opentelemetry-propagator-jaeger) is affected when enabled, because it accepts incoming baggage values without size or count limits. An attacker who can send crafted requests with many or very large baggage values could force excessive CPU and memory use, potentially causing a denial of service in services that do not restrict input size at the transport level.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- open-telemetry opentelemetry-python
fixed in 1.45.0
- opentelemetry-propagator-jaegerPyPI
fixed in 1.45.0