CVE-2026-48504 open-telemetry CVE debrief

Who should care

Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. Operators of systems using OpenTelemetry Rust 0.32.0 or earlier should review their exposure and plan for updates or mitigations. Security teams and vulnerability management teams should prioritize this issue due to its potential impact on resource usage and the availability of a fix in version 0.32.1.

Technical summary

In OpenTelemetry Rust 0.32.0 and earlier, the BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header. This could lead to increased CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. The issue is addressed in version 0.32.1. Affected services may experience increased resource usage when processing oversized baggage headers.

Defensive priority

Medium priority due to potential for increased resource usage and the availability of a fix

Recommended defensive actions

• Inventory and verify OpenTelemetry Rust version
• Upgrade to version 0.32.1 or later if possible
• Monitor for unusual resource usage patterns
• Implement compensating controls for ingress header validation
• Review and adjust security monitoring to detect potential exploitation attempts
• Perform an asset inventory to identify potentially affected systems
• Track and verify the remediation status of affected assets

Evidence notes

Evidence is based on official CVE and NVD records, as well as source references from GitHub. However, detailed impact analysis and affected scope remain limited. To verify, defenders should check the official CVE record and NVD detail page for CVE-2026-48504, review the GitHub commit addressing the issue, and monitor for unusual resource usage patterns. The evidence is grounded in these sources but may not cover all potential impacts or affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.