{"id":"CVE-2026-41178","title":"github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denia…","summary":"A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length i…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-770","vendor":"Red Hat","product":"Red Hat Openshift Data Foundation 4.22","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","builds_for_red_hat_openshift","cert_manager_operator_for_red_hat_openshift","confidential_compute_attestation","cryostat 4","file_integrity_operator","logging_subsystem_for_red_hat_openshift","migration_toolkit_for_applications 8","multicluster_engine_for_kubernetes","multicluster_global_hub","openshift_api_for_data_protection","openshift_lightspeed","openshift_pipelines","openshift_serverless","openshift_service_mesh 3","openshift_source_to_image_s2i","power_monitoring_for_red_hat_openshift","advanced_cluster_management_for_kubernetes 2","advanced_cluster_security 4","ceph_storage 5","ceph_storage 6","ceph_storage 7","ceph_storage 8","ceph_storage 9","certification_program_for_red_hat_enterprise_linux 9","connectivity_link 1","edge_manager 1","enterprise_linux 10","enterprise_linux 9","lightspeed_for_runtimes_operator","openshift_ai_rhoai","openshift_cluster_manager_cli","openshift_container_platform 4","openshift_dev_spaces","openshift_dev_workspaces_operator","openshift_distributed_tracing 3","openshift_for_windows_containers","openshift_gitops","openshift_virtualization 4","openstack_platform 16.2"],"patched":["rhem_1_1_for_rhel 10","rhem_1_2_for_rhel 10","cryostat_4_on_rhel 9","rhem_1_1_for_rhel 9","rhem_1_2_for_rhel 9","enterprise_linux_appstream_eus_v_10_0","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_e4s_v_9_4","enterprise_linux_appstream_eus_v_9_6","enterprise_linux_appstream_v_9","cluster_observability_operator 1.5.0","logging_subsystem_for_red_hat_openshift 6.6","openshift_api_for_data_protection 1.5","advanced_cluster_management_for_kubernetes 2.11","advanced_cluster_management_for_kubernetes 2.13","advanced_cluster_management_for_kubernetes 2.14","advanced_cluster_management_for_kubernetes 2.15","advanced_cluster_management_for_kubernetes 2.16","advanced_cluster_management_for_kubernetes 2.17","developer_hub 1.10","openshift_ai 2.25","openshift_service_mesh 3.4","openshift_distributed_tracing 3.10.2","openshift_distributed_tracing 3.11.1","openshift_data_foundation 4.22","external_secrets_operator_for_red_hat_openshift 1.2"],"published":"2026-06-04","updated":"2026-09-20","sourceUpdated":"2026-09-20T16:34:04+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41178.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41178.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-41178"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2484830"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41178"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41178"},{"url":"https://github.com/open-telemetry/opentelemetry-go/pull/7880"},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"},{"url":"https://access.redhat.com/errata/RHSA-2026:68334"},{"url":"https://access.redhat.com/errata/RHSA-2026:68335"},{"url":"https://access.redhat.com/errata/RHSA-2026:68333"},{"url":"https://access.redhat.com/errata/RHSA-2026:67974"},{"url":"https://access.redhat.com/errata/RHSA-2026:66327"},{"url":"https://access.redhat.com/errata/RHSA-2026:67139"},{"url":"https://access.redhat.com/errata/RHSA-2026:65116"},{"url":"https://access.redhat.com/errata/RHSA-2026:66432"},{"url":"https://access.redhat.com/errata/RHSA-2026:67148"},{"url":"https://access.redhat.com/errata/RHSA-2026:68527"},{"url":"https://access.redhat.com/errata/RHSA-2026:65336"},{"url":"https://access.redhat.com/errata/RHSA-2026:67975"},{"url":"https://access.redhat.com/errata/RHSA-2026:67138"},{"url":"https://access.redhat.com/errata/RHSA-2026:65117"},{"url":"https://access.redhat.com/errata/RHSA-2026:61314"},{"url":"https://access.redhat.com/errata/RHSA-2026:66521"},{"url":"https://access.redhat.com/errata/RHSA-2026:66022"},{"url":"https://access.redhat.com/errata/RHSA-2026:60387"},{"url":"https://access.redhat.com/errata/RHSA-2026:60390"},{"url":"https://access.redhat.com/errata/RHSA-2026:60388"},{"url":"https://access.redhat.com/errata/RHSA-2026:60389"},{"url":"https://access.redhat.com/errata/RHSA-2026:60391"},{"url":"https://access.redhat.com/errata/RHSA-2026:63016"},{"url":"https://access.redhat.com/errata/RHSA-2026:62851"},{"url":"https://access.redhat.com/errata/RHSA-2026:65126"},{"url":"https://access.redhat.com/errata/RHSA-2026:59583"},{"url":"https://access.redhat.com/errata/RHSA-2026:54773"},{"url":"https://access.redhat.com/errata/RHSA-2026:65343"},{"url":"https://access.redhat.com/errata/RHSA-2026:65130"},{"url":"https://access.redhat.com/errata/RHSA-2026:66363"},{"url":"https://github.com/open-telemetry/opentelemetry-go"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00336,"epssPercentile":0.26976,"aliases":["GHSA-5wrp-cwcj-q835","GO-2026-5158"],"ecosystem":"go","ingestedAt":"2026-07-25T19:08:11.062Z","slug":"CVE-2026-41178","body":"## Overview\n\nA flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.\n\n## Vendor advisories\n\n- **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334)\n- **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335)\n- **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333)\n- **RHSA-2026:67974** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67974)\n- **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327)\n- **RHSA-2026:67139** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67139)\n- **RHSA-2026:65116** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65116)\n- **RHSA-2026:66432** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66432)\n- **RHSA-2026:67148** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67148)\n- **RHSA-2026:68527** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68527)\n- **RHSA-2026:65336** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65336)\n- **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, File Integrity Operator, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, … · updated 2026-09-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41178.json)\n- **RHSA-2026:67138** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67138)\n- **RHSA-2026:65117** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65117)\n- **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314)\n- **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521)\n- **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022)\n- **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387)\n- **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390)\n- **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388)\n- **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389)\n- **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391)\n- **RHSA-2026:63016** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63016)\n- **RHSA-2026:62851** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62851)\n- **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583)\n\n**github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers** — rated Important by Red Hat. Released 2026-06-04, updated 2026-09-20.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- Cryostat 4\n- File Integrity Operator\n- Logging Subsystem for Red Hat OpenShift\n- Migration Toolkit for Applications 8\n- Multicluster Engine for Kubernetes\n- Multicluster Global Hub\n- OpenShift API for Data Protection\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- OpenShift Source-to-Image (S2I)\n- Power monitoring for Red Hat OpenShift\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Connectivity Link 1\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Lightspeed for Runtimes Operator\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Cluster Manager CLI\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Dev Workspaces Operator\n- Red Hat OpenShift distributed tracing 3\n- Red Hat OpenShift for Windows Containers\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift Virtualization 4\n- Red Hat OpenStack Platform 16.2\n\nFixed:\n\n- RHEM 1.1 for RHEL 10\n- RHEM 1.2 for RHEL 10\n- Cryostat 4 on RHEL 9\n- RHEM 1.1 for RHEL 9\n- RHEM 1.2 for RHEL 9\n- Red Hat Enterprise Linux AppStream EUS (v. 10.0)\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream E4S (v.9.4)\n- Red Hat Enterprise Linux AppStream EUS (v.9.6)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Cluster Observability Operator 1.5.0\n- Logging Subsystem for Red Hat OpenShift 6.6\n- OpenShift API for Data Protection 1.5\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n- Red Hat Advanced Cluster Management for Kubernetes 2.14\n- Red Hat Advanced Cluster Management for Kubernetes 2.15\n- Red Hat Advanced Cluster Management for Kubernetes 2.16\n- Red Hat Advanced Cluster Management for Kubernetes 2.17\n- Red Hat Developer Hub 1.10\n- Red Hat OpenShift AI 2.25\n- Red Hat OpenShift Service Mesh 3.4\n- Red Hat OpenShift distributed tracing 3.10.2\n- Red Hat OpenShift distributed tracing 3.11.1\n- Red Hat Openshift Data Foundation 4.22\n- external secrets operator for Red Hat OpenShift 1.2\n\nNo fix planned:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Multicluster Engine for Kubernetes\n- Red Hat Advanced Cluster Management for Kubernetes 2\n- Red Hat Advanced Cluster Security 4\n- Red Hat OpenShift Container Platform 4\n- Zero Trust Workload Identity Manager - Tech Preview\n- Red Hat Ceph Storage 5\n- Red Hat Ceph Storage 6\n- Red Hat Ceph Storage 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- Cryostat 4\n- File Integrity Operator\n- Logging Subsystem for Red Hat OpenShift\n- Migration Toolkit for Applications 8\n- Multicluster Global Hub\n- OpenShift API for Data Protection\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- OpenShift Source-to-Image (S2I)\n- Power monitoring for Red Hat OpenShift\n- Red Hat Certification Program for Red Hat Enterprise Linux 9\n- Red Hat Connectivity Link 1\n- Red Hat Edge Manager 1\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Lightspeed for Runtimes Operator\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Cluster Manager CLI\n- Red Hat OpenShift Dev Spaces\n- Red Hat OpenShift Dev Workspaces Operator\n- Red Hat OpenShift distributed tracing 3\n- Red Hat OpenShift for Windows Containers\n- Red Hat OpenShift GitOps\n- Red Hat OpenShift Virtualization 4\n\nNot affected:\n\n- RHEM 1.1 for RHEL 10\n- RHEM 1.2 for RHEL 10\n- Cryostat 4 on RHEL 9\n- RHEM 1.1 for RHEL 9\n- RHEM 1.2 for RHEL 9\n- Cluster Observability Operator 1.5.0\n- Logging Subsystem for Red Hat OpenShift 6.6\n- OpenShift API for Data Protection 1.5\n- Red Hat Advanced Cluster Management for Kubernetes 2.11\n- Red Hat Advanced Cluster Management for Kubernetes 2.13\n\n## Remediation\n\nSee the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334\nSee the following documentation for details on how to enable Red Hat Edge\nManager and more:\nhttps://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 https://access.redhat.com/errata/RHSA-2026:68335\nBefore applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333\n\n## Package advisory (CVE-2026-41178)\n\nAffected packages:\n\n- `go.opentelemetry.io/otel/baggage >= 1.41.0, < 1.42.0`\n- `go.opentelemetry.io/otel/propagation >= 1.41.0, < 1.42.0`\n- `go.opentelemetry.io/otel/baggage >= 1.43.0, < 1.44.0`\n- `go.opentelemetry.io/otel/propagation >= 1.43.0, < 1.44.0`\n\nPatched in:\n\n- `go.opentelemetry.io/otel/baggage 1.42.0`\n- `go.opentelemetry.io/otel/propagation 1.42.0`\n- `go.opentelemetry.io/otel/baggage 1.44.0`\n- `go.opentelemetry.io/otel/propagation 1.44.0`\n\nSource: https://osv.dev/vulnerability/GHSA-5wrp-cwcj-q835","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":5181,"id":"CVE-2026-41178","ts":1788887251961,"field":"cvss","old":"5.3","new":"7.5"},{"seq":5180,"id":"CVE-2026-41178","ts":1788887251961,"field":"severity","old":"medium","new":"high"},{"seq":4064,"id":"CVE-2026-41178","ts":1788886367941,"field":"cvss","old":"7.5","new":"5.3"},{"seq":4063,"id":"CVE-2026-41178","ts":1788886367941,"field":"severity","old":"high","new":"medium"},{"seq":3144,"id":"CVE-2026-41178","ts":1788883132900,"field":"cvss","old":"5.3","new":"7.5"},{"seq":3143,"id":"CVE-2026-41178","ts":1788883132900,"field":"severity","old":"medium","new":"high"}]}