{"id":"ghsa-ghsa-f5m9-jfrj-jjj7","seq":1711758,"kind":"advisory","title":"OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation","url":"https://github.com/advisories/GHSA-f5m9-jfrj-jjj7","permalink":"https://vulnpulse.app/items/ghsa-ghsa-f5m9-jfrj-jjj7","summary":"影響: pip:opentelemetry-propagator-jaeger <= 1.44.0 → 1.45.0\nJaegerPropagator.extract() in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx- baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept. Impact Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk w…","severity":"medium","techs":["python"],"cves":["CVE-2026-116694"],"tags":["GHSA-f5m9-jfrj-jjj7","opentelemetry-propagator-jaeger"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T21:06:54.000Z","fetched_at":"2026-10-27T21:17:52.472Z"}