Skip to content
Fencer Intel
medium 5.3

CVE-2026-128086 json

OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

published 17d ago modified yesterday also GHSA-rrfc-gjm9-cgrj , EUVD-2026-125716

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into internal/baggage.Item. A valid densely populated baggage header can therefore cause allocation traffic and retained memory disproportionate to its bounded input size. Remote impact requires baggage extraction to be enabled, attacker-controlled input to reach it, and extraction to run before authentication or on a public route; the evidence establishes increased allocation and garbage-collection pressure but not reliable process termination. This issue is fixed in version 1.47.0.

Patch / fix

  • go go.opentelemetry.io/otel/baggage 1.47.0
  • go go.opentelemetry.io/otel/propagation 1.47.0

Is CVE-2026-128086 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-128086 updated cvss 5.3

go.opentelemetry.io/otel: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry Go: Denial of Service via crafted baggage headers

  • Red Hat Hardened Images etcd 3.7.3-0.1.hum1, k6v2 2.3.0-0.4.hum1, helm4 4.3.1-0.2.hum1, caddy 2.11.7-0.4.hum1, podman 6.1.1-1.el10_3, grype 0.121.3-0.1.hum1, +16 more
    affected: workaround, no fix available
  • Red Hat Ansible Automation Orchestrator 2026 ansible-automation-platform/automation-orchestrator-rhel9-operator, ansible-automation-platform/automation-orchestrator-temporal-rhel9, ansible-automation-platform/automation-orchestrator-operator-bundle Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9, assisted/agent-preinstall-image-builder-rhel9 Red Hat AWS Load Balancer Operator albo/aws-load-balancer-rhel9-operator, albo/aws-load-balancer-controller-rhel8 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-rhel9-operator, openshift-builds/openshift-builds-waiters-rhel10, openshift-builds/openshift-builds-webhook-rhel10, openshift-builds/openshift-builds-rhel10-operator, +12 more Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-istio-csr-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Compliance Operator compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle, compliance/openshift-compliance-must-gather-rhel8
    +33 more products
    Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9-operator, agent-sandbox/agent-sandbox-rhel9-operator, build-of-trustee/trustee-must-gather-rhel9, openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-must-gather-rhel9, +3 more Red Hat Cost Management On Premise costmanagement/costmanagement-ingress-rhel9 Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9, cryostat/cryostat-rhel9-operator, cryostat/cryostat-grafana-dashboard-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9-operator, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-scaler-rhel9, custom-metrics-autoscaler/custom-metrics-autoscaler-http-add-on-operator-rhel9, +1 more Red Hat DPU kit for NVIDIA dpu-kit-for-nvidia/must-gather-rhel10, dpu-kit-for-nvidia/bluefield-ocp-layer-rhel10, dpu-kit-for-nvidia/dpf-hcp-provisioner-rhel10-operator Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9, exploit-intelligence/vulnerability-analysis-rhel9, exploit-intelligence/exploit-intelligence-operator-controller-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/external-secrets-operator-rhel9 Red Hat ExternalDNS Operator edo/external-dns-rhel8, edo/external-dns-rhel9, edo/external-dns-rhel9-operator Red Hat Fence Agents Remediation Operator workload-availability/fence-agents-remediation-rhel9-operator Red Hat File Integrity Operator compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9, gatekeeper/gatekeeper-rhel9-operator Red Hat Helm CLI for Red Hat OpenShift helm-cli/helm-cli-rhel9 Red Hat Job Set 1 job-set/jobset-rhel9, job-set/jobset-rhel9-operator Red Hat Job Set Tech Preview job-set/jobset-rhel9, job-set/jobset-rhel9-operator, job-set/jobset-operator-bundle Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-rhel9-operator, kmm/kernel-module-management-must-gather-rhel9, kmm/kernel-module-management-hub-rhel9-operator, kmm/kernel-module-management-webhook-server-rhel9 Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator Red Hat Leader Worker Set leader-worker-set/lws-rhel9, leader-worker-set/lws-rhel9-operator Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator, openshift-logging/lokistack-gateway-rhel9, openshift-logging/cluster-logging-rhel9-operator Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9, lvms4/lvms-rhel9-operator, lvms4/lvms-operator-bundle, lvms4/lvms-must-gather-rhel9 Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel9-operator, workload-availability/machine-deletion-remediation-operator-bundle Red Hat MCP Lifecycle Operator mcp-lifecycle-operator-beta/mcp-lifecycle-rhel9-operator Red Hat MCP Server for Red Hat OpenShift openshift-mcp/openshift-mcp-server-rhel9, openshift-mcp-tech-preview/openshift-mcp-server-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-hub-rhel9, mta/mta-rhel9-operator, mta/mta-agent-java-rhel9, mta/mta-analyzer-addon-rhel9, mta/mta-solution-server-rhel9, +5 more Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-registry-rhel8, rhmtc/openshift-migration-controller-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-validation-rhel9, migration-toolkit-virtualization/mtv-must-gather-rhel9, migration-toolkit-virtualization/mtv-populator-controller-rhel9, migration-toolkit-virtualization/mtv-vsphere-copy-offload-populator-rhel9, migration-toolkit-virtualization/mtv-vsphere-xcopy-volume-populator-rhel9 Red Hat mirror registry for Red Hat OpenShift 3 openshift/mirror-registry-rhel9 Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator, multiarch-tuning/multiarch-tuning-operator-bundle Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel9, multicluster-engine/work-rhel9, multicluster-engine/maestro-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/must-gather-rhel9, multicluster-engine/registration-rhel9, +26 more Red Hat Multicluster Engine for Kubernetes 5 multicluster-engine/hive-rhel9, multicluster-engine/work-rhel9, multicluster-engine/maestro-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/must-gather-rhel9, multicluster-engine/registration-rhel9, +22 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator Red Hat Multicluster Global Hub 5 multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator Red Hat Network Observability Operator network-observability/network-observability-cli-rhel9, network-observability/network-observability-rhel9-operator, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9
    under investigation

61 more under investigation, 1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-14).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/baggage
>=1.0.0-RC1, <1.47.0
1.47.0
go go.opentelemetry.io/otel/propagation
>=1.0.0-RC1, <1.47.0
1.47.0

Affected products

  • open-telemetry opentelemetry-go

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-405 Asymmetric Resource Consumption (Amplification)

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of open-telemetry/opentelemetry-go published their own advisory on GitHub. Reviewed sources take precedence over it.