CVE-2026-41178: 
cAdvisor vulnerability analysis and mitigation

CVE-2026-41178 is a Denial-of-Service vulnerability in OpenTelemetry-Go's baggage parsing component, caused by the removal of raw header length validation. Pull request #7880, which aimed to align the implementation with W3C Baggage specification limits, inadvertently removed the upfront baggage-string length check and per-member size guard, allowing the Parse function to process arbitrarily large or malformed baggage headers. The affected packages are go.opentelemetry.io/otel/baggage and go.opentelemetry.io/otel/propagation at versions 1.41.0 and 1.43.0; fixed versions are 1.42.0 and 1.44.0. The vulnerability was published on May 28, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-789 (Memory Allocation with Excessive Size Value). PR #7880 removed the upfront bStr length check and the per-member byte limit (maxBytesPerMembers) from baggage/baggage.go, leaving Parse to iterate over all list members via strings.SplitSeq without any raw-length guard. For each member, parseMember performs full parsing and PathUnescape (percent-decoding), amplifying CPU and memory work for large inputs. Additionally, in propagation/baggage.go, parse errors from attacker-controlled headers are forwarded to the global error handler, which logs by default, enabling log amplification. Exploitation requires no authentication or special privileges — an attacker simply sends an oversized or malformed baggage HTTP/gRPC header to any instrumented service using the OpenTelemetry baggage propagator. A proof-of-concept (baggage_dos_poc.tar.gz) was published alongside the advisory (GitHub Advisory, PR #7880).

Successful exploitation results in availability degradation through CPU and log amplification on services that use the OpenTelemetry baggage propagator for inbound request parsing. There is no confidentiality or integrity impact — the vulnerability is strictly availability-only. The severity is bounded by the hosting server or proxy's header size limits and whether the default error handler (which logs parse errors) is in use; services with strict upstream header size enforcement or a suppressed error handler are less affected (GitHub Advisory).

A proof-of-concept (baggage_dos_poc.tar.gz) is publicly available and was attached to the GitHub security advisory at the time of disclosure (GitHub Advisory). The vulnerability is remotely exploitable with no authentication, no user interaction, and low attack complexity. The EPSS score is approximately 0.039–0.051% (16th percentile), indicating a low but non-zero probability of exploitation in the near term (Github Advisory). There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify services instrumented with OpenTelemetry-Go versions 1.41.0 or 1.43.0 that expose HTTP or gRPC endpoints and use the propagation.Baggage propagator for inbound request parsing.
2. Craft oversized/malformed baggage header: Construct an HTTP request with an extremely large or malformed baggage header value — for example, a header containing thousands of comma-separated key=value members or percent-encoded garbage data that exceeds the 8KB valid-member limit but passes the transport layer's header size check.
3. Send the request: Transmit the crafted request to the target service endpoint. If the upstream proxy or server does not enforce strict header size limits, the oversized header will reach the OpenTelemetry baggage parser.
4. Trigger CPU/log amplification: The vulnerable Parse function iterates over all members with strings.SplitSeq, calls parseMember and PathUnescape on each, and forwards errors to the global error handler (default: logging). This causes excessive CPU consumption and potentially large log output.
5. Sustain the attack: Repeat requests at volume to sustain CPU and log amplification, degrading service availability (GitHub Advisory).

• Network: High volumes of HTTP/gRPC requests containing unusually large baggage headers (exceeding several kilobytes) targeting instrumented service endpoints.
• Logs: Repeated parse error log entries from the OpenTelemetry global error handler related to baggage parsing failures; sudden spike in log volume correlated with inbound requests.
• Process: Elevated CPU utilization on Go service processes handling inbound requests, without a corresponding increase in legitimate business traffic.

Upgrade go.opentelemetry.io/otel/baggage and go.opentelemetry.io/otel/propagation to version 1.42.0 or 1.44.0, which restore raw-length validation and enforce W3C Baggage specification limits (64 members, 8192 bytes combined) (GitHub Advisory). As a temporary workaround prior to patching, configure the upstream HTTP server or reverse proxy to enforce strict header size limits so that oversized baggage headers are rejected before reaching the application. Additionally, replacing the default global error handler with one that suppresses or rate-limits parse error logging will reduce the log amplification impact.