CVE-2026-45292

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45292
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45292.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-45292
Aliases
Downstream
Published
2026-05-28T16:37:29Z
Modified
2026-09-09T08:18:15Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
Details

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45292.json"
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-java

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
d03621fb3c3aa7f31d31b684ada2e9a8a93f158a
Fixed
03837d3c1763bc35464aea1078671e2ef2336a5f
Fixed
d03621fb3c3aa7f31d31b684ada2e9a8a93f158a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.62.0"
        },
        {
            "introduced": "1.62.0"
        },
        {
            "last_affected": "1.62.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.62.0
v0.*
v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v1.*
v1.0.0
v1.1.0
v1.10.0
v1.10.0-rc.1
v1.10.0-rc.2
v1.11.0
v1.12.0
v1.2.0
v1.3.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45292.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "228950356609877868758791773050477987897",
            "length": 332
        },
        "id": "CVE-2026-45292-0f735734",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java",
            "function": "putBaggage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "309334547631565040319040629272525574479",
            "length": 572
        },
        "id": "CVE-2026-45292-1832a659",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java",
            "function": "baggageToString"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "101447758375284263948653778924649079016",
                "147333328675828053810151871517722132937",
                "200744724238036848902017928333672617241",
                "183992973757728204299737840062866885954",
                "53562218041366311605399652144696834748",
                "68279050571543324039906946472774706896",
                "262089102782194850447234319751262558355",
                "95685806190671045297024763373365639859",
                "160145683896610303744686241164658037883",
                "148729382876915712334932268350176933519",
                "334957753244604684699178766247491690474",
                "231238799032561628781206441842588202033",
                "127867779465824305634121116988717328922",
                "259906127412495501315534019782483132884",
                "68523714707972739852901428267813802985",
                "190004690390445008988815686517467481243",
                "272053739604272298851157136930905059618",
                "69628561152478518786006821070779828464",
                "216199204779542520378088291092043111077"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45292-2df25772",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "324040298607633099239747925521181692285",
            "length": 94
        },
        "id": "CVE-2026-45292-3217a024",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java",
            "function": "extractEntries"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "2736157610361857025527732691065087203",
                "86435547091767786361426411324429584358",
                "41177967652305490077281618619690476460",
                "53056691527998116437139607088840810649",
                "200444032932188625533046905973486136310",
                "322215403787429048323761220146177576815",
                "340130063425991297414784349311592936190",
                "52000232421443451450877966028549862428",
                "229650805912405071560475496753778742245",
                "200966310157433461865540336404663962630",
                "290686205111362739751168408941015981435",
                "226379763402180177718224749577998004598",
                "293742249982255448599687901397687808266",
                "128115566370171621987030639128416822867",
                "128063808075106022048355774255772526981",
                "220765276456906269112572466292227184726",
                "235302921452623369068620557109957356399",
                "148540107334669822672307653149093924506",
                "231650651611206962808810877422094108649",
                "161793007183578077616834888632390771327",
                "110835381729137979723145489692899493645",
                "7599191191882320167505444953349458675",
                "339403475527353307448176744553962954099",
                "289593621153771310375623480448877062179",
                "29415257308678424589951977246591929667",
                "241730058457481652234845595266595623415",
                "47914828783880551553164836963674179323",
                "280795312696270798208652171823018313137",
                "225729826646794272243606684600811419553",
                "244584886160422946585839938600532990305",
                "284149173263861833489906033555612198803",
                "113866770370623367670363381828884451198",
                "174449262980615703894916509034162717800",
                "39166625609584491556473546578842242931",
                "193910834392300100989649934959087756365",
                "153985727346855901549590759067985026754",
                "242564297933134908170296124984925163564",
                "305455182349108538775657664142858524168",
                "214875562571116176303512337697604680933",
                "327691809867499953730582283444104874265",
                "190701536751006470679815687929121470314",
                "309691432462170197969715861949115981023",
                "99135934049104599925931164446588462403"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45292-3b0e2afc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "18398855200978346088302344929080993256",
            "length": 473
        },
        "id": "CVE-2026-45292-4b8b0853",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagator.java",
            "function": "extractMulti"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "289875203222079088686919194446068685093",
            "length": 693
        },
        "id": "CVE-2026-45292-51caa593",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java",
            "function": "inject"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "57422983355185685798677884843937778398",
                "86471840035482204802109395694954600873",
                "239987252347493383961100522199334614303",
                "166750851672169983731451394049415691860",
                "230187549525644793848853761859914754642",
                "137664863221316513551598494816248060484",
                "264023897608771092923793707284935983213",
                "214561367730798019122639144325961192990",
                "224551665289327638480037572783293209200",
                "255744619664452528395280925254114108237",
                "44582178634639660520984032379100376832",
                "329340391870657849627795609049280505588",
                "131871532952430929400321684155676094120",
                "7926157107541989220678153033410614323",
                "336948967958980590273334651720366142188",
                "268844915984555954091136723938662598922",
                "298721777215713470840312602678433837423"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45292-5457b19b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/test/java/io/opentelemetry/extension/trace/propagation/OtTracePropagatorTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "16057343206135996351300200025482210473",
            "length": 202
        },
        "id": "CVE-2026-45292-61299af3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java",
            "function": "injectBaggage"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "325989081887590977161991403427085452360",
            "length": 1236
        },
        "id": "CVE-2026-45292-71a3cbde",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/OtTracePropagator.java",
            "function": "extract"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "272028938564614111152577707812895728378",
            "length": 334
        },
        "id": "CVE-2026-45292-80d5ec6e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java",
            "function": "parseBaggageHeader"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "11031647112383166876003824258982174962",
            "length": 1551
        },
        "id": "CVE-2026-45292-91ec5843",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java",
            "function": "parseInto"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "239345630250743580483968896944488439413",
                "337034480761630260594198419762749273068",
                "105171261500783072282133845295030967368",
                "302142561053748229476123246783180390104",
                "239574872035521831017091315731564658955",
                "73951333417615050995495367384191892471",
                "156004208839988196159896163803951028813",
                "327844966003215203401321592027192772804",
                "197588040595289848873249040457061994998",
                "305767223277710999442536515673581540461",
                "227297817023754502556516364711088397437",
                "256240598407376171183108265241040949147",
                "78833074397608598403735516491452787468",
                "64323587913788000661923030633447762562",
                "5812748884965767207211840640618430241",
                "336390307670648052519699553053404448772",
                "203074136614452997952031730341320237450",
                "34815311774140407507144298041252954955"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45292-b879fafc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/test/java/io/opentelemetry/api/baggage/propagation/W3CBaggagePropagatorTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "33080079480296023145388178458139894476",
                "2923213682616713978173602717812943260",
                "28896537007609620556867889160382359779",
                "123475029095939059690915194882056320776",
                "119539450348303551703714467228488206882",
                "124389229736369702492630146280660614404",
                "183206172447372457926039324847483789068",
                "214546313599121294249009182193536051778",
                "81405965628241265660210608473733093391",
                "24596351879490959764319191901809669688",
                "329340391870657849627795609049280505588",
                "283368615391408689722037177507991485186",
                "236684645129237460536720298385424586785",
                "152374337647870118177880266298173998168",
                "174657051201628902770438195884818994992",
                "72390310119854681659869645598363997275"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45292-cb8b011a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/test/java/io/opentelemetry/extension/trace/propagation/JaegerPropagatorTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "225563818499233367519022669779838315019",
                "277714487139591758900983597709715611908",
                "67785612765065382128031478595599195032",
                "237121721588638052542475859018682851837",
                "39540601855233475791007790758198444129",
                "2031994772797113595152393846679653499",
                "172624610666532659232895157331884203169",
                "286622679712599912238124505164641853587",
                "220806260929443147353265464079843191903",
                "188663697407482894313058447745134838416",
                "156976945363984426358817669915175673149",
                "31520473516259012413094303550304700291",
                "46033727661262132662501271637269650234",
                "9810993886405726943558573783002640349",
                "72375414593571301766433226169901390469",
                "119801564351374144698840815379221974868",
                "224138421188025658000231347261174208922",
                "144585335175953505213391907047729891864",
                "215023468345882789514941138672616764895",
                "77147113895842293715888192562814974798",
                "188392142685785950450023835311063741502",
                "14887411100419948675168123558039147821",
                "262366377240734211349481133880693438531",
                "102614813815977114487314424211865996969",
                "119997976285540997734493601518612964231",
                "84712053147649686417702451363068651763",
                "106723926582822914670304753730225338287",
                "191785466615703180739792607217424534098",
                "92715705812415012041431899488602445184",
                "239900951165186684239348646971257232840",
                "196655747857919072290822505179275858796",
                "100149592621763266595244546171067718398",
                "129289305148052155536605975208026808028",
                "323358386069968239544135410951793021442",
                "152908977494773281664915813969161000058",
                "306013695714167092383886980704411086755",
                "227271501807411227296581694400632553058",
                "3767369795944466534786766635767762622",
                "121828939624704043642154626050702204704",
                "227628861948579671534354922044173792301",
                "313406723938225126255804049122573465064",
                "109261829156171815691256093511460764140",
                "313711046943558329276718594776674616847",
                "177153116393120700348301308916413196081"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45292-cff19bb0",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "288778143410670638095168990784169960099",
            "length": 821
        },
        "id": "CVE-2026-45292-ee0826fd",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "extensions/trace-propagators/src/main/java/io/opentelemetry/extension/trace/propagation/JaegerPropagator.java",
            "function": "getBaggageFromHeader"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "294856610575432090025282065914156859268",
            "length": 68
        },
        "id": "CVE-2026-45292-eed10c13",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java",
            "function": "Parser"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "144991873732987924352070841534908749276",
                "113249383205500147450345369716031573471",
                "67819586397585278965431929330641645003",
                "243041489747333960372742448711995971626",
                "287923327682074635675616588623859257505",
                "11519041757850507829222762636861525651",
                "78599831323481765895624604533738841437",
                "190917584330989715769223351112918498164",
                "286191209785037123426353571988930896822",
                "217170081702381849486234240711059033903",
                "156755348991413335325671692302735179952",
                "134674499688784999131130620152179436432",
                "128948794105523786542523631109305918866",
                "188838211524901183685762391391601263058",
                "75407180318704451699303769443305508093",
                "108587633537507210242609878158511307392",
                "316015335210385615884675010095580741713",
                "172949875226896649181066246542847102669",
                "71621010025911738797948271325213320837",
                "329793816160020523949891269214878561399",
                "176622313265287167532456455831121001161",
                "90257972463375921783361897042811391098",
                "311572496888965192775199114864530964575",
                "326261317385562529874568081672142801835",
                "221171341465066986048389800378139756222",
                "228663846087108107510970641859131755953",
                "79901192235391821134937543294836292522",
                "108284150120597359644081533265565666360"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-45292-fa77efcb",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
        "target": {
            "file": "api/all/src/main/java/io/opentelemetry/api/baggage/propagation/Parser.java"
        }
    }
]
vanir_signatures_modified 
"2026-09-09T08:18:15Z"