CVE-2026-116694 open-telemetry CVE debrief

Who should care

Defenders and administrators of services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers should assess exposure and prioritize verification and remediation. This includes roles responsible for configuring and securing OpenTelemetry Python deployments, especially in environments where transport-level limits may be absent or configured above baggage limits.

Why it matters

CVE-2026-116694 involves unbounded memory allocation in Jaeger baggage propagation in opentelemetry-propagator-jaeger. Defenders should prioritize verifying and upgrading to version 1.45.0 or later, especially for deployments that enable the Jaeger propagator and accept untrusted inbound propagation headers. The practical impact for most Python web deployments is limited, but verification and remediation are necessary to mitigate potential denial-of-service risk.

• Increased per-request resource usage due to unbounded memory allocation
• Potential denial-of-service risk when transport-level limits are absent or configured above baggage limits
• Verification priority for deployments with custom TextMapGetter implementations or non-HTTP transports

Technical summary

The JaegerPropagator.extract() function in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx-* baggage headers. This could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept. The practical impact for most Python web deployments is limited due to default configurations and constraints in common Python web servers.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.45.0 or later of opentelemetry-propagator-jaeger, especially for deployments that enable the Jaeger propagator and accept untrusted inbound propagation headers.

Recommended defensive actions

• Verify the version of opentelemetry-propagator-jaeger in use and upgrade to version 1.45.0 or later if necessary.
• Review and adjust transport-level limits and configurations for the Jaeger propagator and Python web servers to align with baggage limits.
• Monitor for and limit exposure to untrusted inbound propagation headers in deployments that enable the Jaeger propagator.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details on the vulnerability in opentelemetry-propagator-jaeger. The issue involves unbounded memory allocation in Jaeger baggage propagation, which could lead to increased resource usage and denial-of-service risk. However, the practical impact for most Python web deployments is limited due to default configurations and constraints in common Python web servers like Gunicorn and Uvicorn.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.