OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade openshift | Sep 24, 2026 | Jun 4, 2026 |
| Redhat_linux | — | Upgrade osbuild-composer-coreUpgrade osbuild-composer-core-debuginfoUpgrade image-builder-debuginfoUpgrade flightctl-selinuxUpgrade image-builder-debugsourceUpgrade ignitionUpgrade ignition-edgeUpgrade ignition-debugsourceUpgrade image-builderNo solution existsUpgrade flightctl-cliUpgrade ignition-debuginfoUpgrade ignition-grubUpgrade ignition-validate-debuginfoUpgrade flightctl-observabilityUpgrade osbuild-composer-debuginfoUpgrade opentelemetry-collectorUpgrade osbuild-composer-workerUpgrade osbuild-composer-tests-debuginfoUpgrade flightctl-agentUpgrade osbuild-composer-worker-debuginfoUpgrade flightctl-servicesUpgrade osbuild-composer-debugsourceUpgrade ignition-validateUpgrade osbuild-composer | Aug 17, 2026 | Jun 4, 2026 |
| Rocky_linux | — | Upgrade osbuild-composer-debugsourceUpgrade osbuild-composer-worker-debuginfoUpgrade osbuild-composer-workerUpgrade osbuild-composer-debuginfoUpgrade opentelemetry-collectorUpgrade osbuild-composerUpgrade image-builderUpgrade image-builder-debugsourceUpgrade image-builder-debuginfoUpgrade osbuild-composer-core-debuginfoUpgrade osbuild-composer-core | Sep 15, 2026 | Sep 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub