CVE-2026-29181: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-29181 is a Denial of Service vulnerability in OpenTelemetry-Go (the Go implementation of OpenTelemetry) caused by inefficient multi-value baggage header extraction that allows unauthenticated remote attackers to amplify CPU usage and memory allocations. It affects go.opentelemetry.io/otel/baggage and go.opentelemetry.io/otel/propagation versions >= 1.36.0 and <= 1.40.0. The vulnerability was published on April 7, 2026, and is tracked under GHSA-mh2q-q3fh-2475. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, OTel Security Advisory).

The root cause (CWE-400: Uncontrolled Resource Consumption; CWE-770: Allocation of Resources Without Limits or Throttling) lies in the extractMultiBaggage function in propagation/baggage.go (line 58). This function iterates over all baggage: HTTP header field-values and parses each one independently via baggage.Parse, then aggregates members into a shared slice — repeating the full parsing work once per header line. The 8192-byte cap applies per individual header value, not across all values combined, so an attacker can send many baggage: header lines (bounded only by the server's total header byte limit, e.g., 1 MB in Go's default net/http) to multiply CPU and allocation work with no authentication required. A PoC harness demonstrates that 80 baggage values across 40 requests yields ~10.3 MB of allocations per request versus ~133 KB for a single-value baseline (OTel Security Advisory).

Successful exploitation causes a significant availability impact: an unauthenticated attacker can exhaust CPU and memory resources on any Go service using the affected OpenTelemetry propagation packages, leading to increased request latency and potential denial of service. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Given the widespread use of OpenTelemetry in cloud-native and microservice environments, affected deployments could experience cascading service degradation under sustained attack (Github Advisory, OTel Security Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, including a PoC harness with concrete reproduction steps (unzip, make test) and specific attack parameters (80 baggage values, 40 requests) that demonstrate the amplification effect (OTel Security Advisory). No in-the-wild exploitation has been observed as of the time of publication. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.04–0.077%, indicating a low near-term exploitation probability. No threat actor attribution is available.

1. Identify target: Locate a Go service that uses go.opentelemetry.io/otel/propagation versions 1.36.0–1.40.0 and accepts inbound HTTP requests with baggage: header propagation enabled.
2. Craft malicious request: Construct an HTTP request containing a large number of separate baggage: header lines (e.g., 80 lines), each with a valid baggage value up to 8192 bytes. Each line is individually within the per-value parse limit but collectively far exceeds what a single comma-joined value would require.
3. Send requests: Transmit the crafted requests to the target service endpoint. In Go's default net/http configuration (1 MB max header bytes), this allows sending many such header lines per request.
4. Trigger amplification: Each request causes extractMultiBaggage to invoke baggage.Parse once per header line and aggregate members, resulting in ~10.3 MB of allocations per request (vs. ~133 KB baseline) and elevated latency (p95 ~7 ms vs. ~0 ms baseline).
5. Sustain DoS: Repeat requests at moderate volume to exhaust server CPU and memory, degrading or denying service to legitimate users (OTel Security Advisory).

• Network: HTTP requests to application endpoints containing an unusually high number of baggage: header lines (e.g., 10 or more separate baggage: headers per request); requests with total header sizes approaching the server's maximum (1 MB in default Go net/http).
• Logs: Application or access logs showing elevated request latency (p95 > 2 ms) for requests with multiple baggage: headers; Go runtime logs indicating high memory allocation rates or GC pressure correlated with specific request patterns.
• Process: Sudden spikes in CPU and memory usage on Go services using OpenTelemetry propagation, particularly correlated with inbound HTTP traffic; Go garbage collector running more frequently than baseline.

The fix is available in OpenTelemetry-Go version 1.41.0, released March 2, 2026. The patch (PR #7880, commit aa1894e) enforces W3C Baggage specification limits globally across all header values: a combined maximum of 8192 bytes and 64 members across all baggage: header lines, treating multi-value headers as a single budget rather than per-value. As a temporary workaround prior to upgrading, operators should implement rate limiting on HTTP requests and configure reverse proxies or load balancers to limit the number of baggage: header lines per request. Upgrading to v1.41.0 or later is the recommended remediation (OTel Release v1.41.0, Fix PR).

The vulnerability was reported by security researcher 1seal and remediated by XSAM (a contributor to the OpenTelemetry-Go project). The fix was reviewed and approved by multiple OpenTelemetry maintainers including MrAlias, dashpole, dmathieu, and pellared before being merged. CISA included the vulnerability in its weekly vulnerability bulletin (SB26-103) for the week of April 6, 2026 (CISA Bulletin). Coverage also appeared on security aggregation sites and AWS security change tracking, reflecting broad awareness in the cloud-native community.