CVE-2026-41178

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.

This is an Important denial of service vulnerability in OpenTelemetry-Go, affecting versions 1.41.0 and 1.43.0. An attacker can exploit this flaw by sending oversized baggage headers, causing the Parse function to process invalid inputs and log errors, which can lead to resource exhaustion and service disruption in Red Hat products utilizing these affected OpenTelemetry-Go versions. The impact is considered Important due to the potential for remote, unauthenticated denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.