CVE-2026-48504— OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| open-telemetry | opentelemetry-rust | < 0.32.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-48504
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation
Source: CVE Program / CVE List V5
Vulnerability Description
OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Vulnerability Title
OpenTelemetry - CNCF OpenTelemetry Rust 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenTelemetry - CNCF OpenTelemetry Rust是OpenTelemetry - CNCF组织的一个OpenTelemetry的Rust实现库。 OpenTelemetry - CNCF OpenTelemetry Rust 0.32.1之前版本存在资源管理错误漏洞，该漏洞源于在解析入站baggage标头前未强制执行W3C Baggage大小限制，可能导致大型攻击者控制的标头造成不必要的CPU工作和短时堆分配。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-telemetry | opentelemetry-rust | < 0.32.1 | - |
II. Public POCs for CVE-2026-48504
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-48504
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-48504 (1)
Vendor Advisories for CVE-2026-48504 (1)
IV. Related Vulnerabilities
Same vendor: open-telemetry
- CVE-2026-59892
OpenTelemetry JavaScript: Denial of service in `JaegerPropag - CVE-2026-54712
OpenTelemetry Javaagent RMI context propagation allows resou - CVE-2026-54704
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentatio - CVE-2026-54285
opentelemetry-js: Unbounded memory allocation in W3C Baggage - CVE-2026-44967
opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP r
Same weakness: CWE-770
- CVE-2026-13069
Queryable Encryption FLE2 Find Payload Missing Input Validat - CVE-2026-13074
Awaitable Hello Command in Exhaust Mode Unthrottled Response - CVE-2026-13075
$rankFusion and $scoreFusion Unbounded Memory Allocation Dur - CVE-2026-13076
Aggregation Framework Memory Exhaustion Leading to Process T - CVE-2026-65650
Elgg 7.0.0以下版本头像上传拒绝服务漏洞
V. Comments for CVE-2026-48504
No comments yet