CVE-2026-48504: 
Rust vulnerability analysis and mitigation

CVE-2026-48504 is an unbounded memory allocation vulnerability in the opentelemetry_sdk Rust crate affecting the W3C Baggage propagation component. The BaggagePropagator::extract_with_context function failed to enforce W3C Baggage size limits prior to parsing inbound baggage headers, allowing oversized attacker-controlled headers to trigger unnecessary CPU work and heap allocations. All versions up to and including 0.32.0 of the opentelemetry_sdk (Rust) package are affected; version 0.32.1 contains the fix. The vulnerability was first published on May 26, 2026, and added to the GitHub Advisory Database on June 25, 2026, with a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, OTel Rust Advisory).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): the SDK parsed the full content of an inbound baggage HTTP header before applying its internal storage limits, meaning entries that would ultimately be discarded were still fully parsed. An unauthenticated remote attacker can exploit this by sending HTTP requests with an oversized baggage header — potentially containing many list-members or a payload exceeding 8192 bytes — to any service that uses OpenTelemetry propagation extraction. No authentication, special privileges, or user interaction is required. The fix in version 0.32.1 enforces W3C Baggage limits upfront: a maximum of 64 list-members and 8192 bytes total header size (GitHub Advisory, OTel Rust Advisory).

The impact of this vulnerability is limited to availability. Successful exploitation causes increased per-request CPU consumption and short-lived heap allocations on affected services, which can degrade performance or contribute to denial-of-service conditions — particularly in environments where application or transport-level header size limits are absent or set above the W3C Baggage thresholds. There is no risk of confidentiality or integrity compromise: telemetry data is neither exposed nor modified, and code execution is not possible (GitHub Advisory).

1. Identify target services: Locate services built with the Rust opentelemetry_sdk crate version ≤ 0.32.0 that accept inbound HTTP requests with W3C Baggage propagation headers enabled.
2. Craft oversized baggage header: Construct an HTTP request containing a baggage header that exceeds 8192 bytes or includes more than 64 list-members (e.g., baggage: key1=value1,key2=value2,... repeated to exceed limits).
3. Send repeated requests: Flood the target service with these crafted requests to maximize CPU and heap allocation overhead per request, amplifying the denial-of-service effect.
4. Observe degradation: Monitor for increased latency, elevated CPU usage, or service unavailability as the SDK parses and then discards the oversized header entries on each request (GitHub Advisory).

• Network: Inbound HTTP requests with unusually large baggage headers (>8192 bytes) or headers containing more than 64 comma-separated list-members targeting services instrumented with OpenTelemetry.
• Logs: Elevated per-request processing times logged by the application or proxy layer; repeated requests from the same source IP with oversized baggage header values.
• Process: Abnormal CPU spikes or increased heap allocation rates in Rust services using opentelemetry_sdk ≤ 0.32.0, correlating with inbound request volume.

Upgrade opentelemetry_sdk (Rust) to version 0.32.1 or later, which enforces W3C Baggage limits of 8192 bytes total and a maximum of 64 list-members before parsing. If an immediate upgrade is not feasible, configure a proxy, API gateway, middleware layer, or custom carrier boundary to reject or truncate inbound baggage headers exceeding 8192 bytes before they reach OpenTelemetry propagation extraction. Related advisories exist for OpenTelemetry Java (GHSA-rcgg-9c38-7xpx) and Go (GHSA-mh2q-q3fh-2475), and those SDKs should be reviewed and patched as well (GitHub Advisory, OTel Rust Advisory).