CVE-2026-41178High· 7.5▾ Twilight

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denia…

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length i…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 4, 2026

Updated

Sep 20, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat Openshift Data Foundation 4.22

CWE

CWE-770

Depth score

41 · Moderate

EPSS

0.34% · p27

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 25.

0.2% → 0.3%▲ 0.10%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

10 events · 108 days

Jun 4, 2026Published
Disclosed via CSAF
Jul 25, 2026EPSS first tracked
0.2%
Aug 22, 2026EPSS peak
0.2% → 0.3%
Sep 8, 2026CVSS changed
5.3 → 7.5
Sep 8, 2026Severity changed
medium → high
Sep 8, 2026CVSS changed
7.5 → 5.3
Sep 8, 2026Severity changed
high → medium
Sep 8, 2026CVSS changed
5.3 → 7.5
Sep 8, 2026Severity changed
medium → high
Sep 20, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-770 #csaf #vex #red-hat #osv #go

Affected

Patched in

rhem_1_1_for_rhel 10
rhem_1_2_for_rhel 10
cryostat_4_on_rhel 9
rhem_1_1_for_rhel 9
rhem_1_2_for_rhel 9
enterprise_linux_appstream_eus_v_10_0
enterprise_linux_appstream_v_10
enterprise_linux_appstream_v_8
enterprise_linux_appstream_e4s_v_9_4
enterprise_linux_appstream_eus_v_9_6
enterprise_linux_appstream_v_9
cluster_observability_operator 1.5.0
logging_subsystem_for_red_hat_openshift 6.6
openshift_api_for_data_protection 1.5
advanced_cluster_management_for_kubernetes 2.11
advanced_cluster_management_for_kubernetes 2.13
advanced_cluster_management_for_kubernetes 2.14
advanced_cluster_management_for_kubernetes 2.15
advanced_cluster_management_for_kubernetes 2.16
advanced_cluster_management_for_kubernetes 2.17
developer_hub 1.10
openshift_ai 2.25
openshift_service_mesh 3.4
openshift_distributed_tracing 3.10.2
openshift_distributed_tracing 3.11.1
openshift_data_foundation 4.22
external_secrets_operator_for_red_hat_openshift 1.2

Full technical detail▾

Overview

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.

Vendor advisories

RHSA-2026:68334 · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:68335 · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:68333 · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:67974 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-16 · advisory
RHSA-2026:66327 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · advisory
RHSA-2026:67139 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · advisory
RHSA-2026:65116 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · advisory
RHSA-2026:66432 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-11 · advisory
RHSA-2026:67148 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-14 · advisory
RHSA-2026:68527 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-17 · advisory
RHSA-2026:65336 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-08 · advisory
Red Hat VEX · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, File Integrity Operator, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, … · updated 2026-09-20 · vex
RHSA-2026:67138 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · advisory
RHSA-2026:65117 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-08 · advisory
RHSA-2026:61314 · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · advisory
RHSA-2026:66521 · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · advisory
RHSA-2026:66022 · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · advisory
RHSA-2026:60387 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · advisory
RHSA-2026:60390 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · advisory
RHSA-2026:60388 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · advisory
RHSA-2026:60389 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · advisory
RHSA-2026:60391 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · advisory
RHSA-2026:63016 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-03 · advisory
RHSA-2026:62851 · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-09-02 · advisory
RHSA-2026:59583 · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · advisory

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers — rated Important by Red Hat. Released 2026-06-04, updated 2026-09-20.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Cryostat 4
File Integrity Operator
Logging Subsystem for Red Hat OpenShift
Migration Toolkit for Applications 8
Multicluster Engine for Kubernetes
Multicluster Global Hub
OpenShift API for Data Protection
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Service Mesh 3
OpenShift Source-to-Image (S2I)
Power monitoring for Red Hat OpenShift
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat Lightspeed for Runtimes Operator
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Cluster Manager CLI
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift distributed tracing 3
Red Hat OpenShift for Windows Containers
Red Hat OpenShift GitOps
Red Hat OpenShift Virtualization 4
Red Hat OpenStack Platform 16.2

Fixed:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
Cryostat 4 on RHEL 9
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Red Hat Enterprise Linux AppStream EUS (v. 10.0)
Red Hat Enterprise Linux AppStream (v. 10)
Red Hat Enterprise Linux AppStream (v. 8)
Red Hat Enterprise Linux AppStream E4S (v.9.4)
Red Hat Enterprise Linux AppStream EUS (v.9.6)
Red Hat Enterprise Linux AppStream (v. 9)
Cluster Observability Operator 1.5.0
Logging Subsystem for Red Hat OpenShift 6.6
OpenShift API for Data Protection 1.5
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13
Red Hat Advanced Cluster Management for Kubernetes 2.14
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat Advanced Cluster Management for Kubernetes 2.16
Red Hat Advanced Cluster Management for Kubernetes 2.17
Red Hat Developer Hub 1.10
Red Hat OpenShift AI 2.25
Red Hat OpenShift Service Mesh 3.4
Red Hat OpenShift distributed tracing 3.10.2
Red Hat OpenShift distributed tracing 3.11.1
Red Hat Openshift Data Foundation 4.22
external secrets operator for Red Hat OpenShift 1.2

No fix planned:

Assisted Installer for Red Hat OpenShift Container Platform 2
Multicluster Engine for Kubernetes
Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat Advanced Cluster Security 4
Red Hat OpenShift Container Platform 4
Zero Trust Workload Identity Manager - Tech Preview
Red Hat Ceph Storage 5
Red Hat Ceph Storage 6
Red Hat Ceph Storage 7
Red Hat Ceph Storage 8
Red Hat Ceph Storage 9
Builds for Red Hat OpenShift
cert-manager Operator for Red Hat OpenShift
Confidential Compute Attestation
Cryostat 4
File Integrity Operator
Logging Subsystem for Red Hat OpenShift
Migration Toolkit for Applications 8
Multicluster Global Hub
OpenShift API for Data Protection
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Service Mesh 3
OpenShift Source-to-Image (S2I)
Power monitoring for Red Hat OpenShift
Red Hat Certification Program for Red Hat Enterprise Linux 9
Red Hat Connectivity Link 1
Red Hat Edge Manager 1
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Red Hat Lightspeed for Runtimes Operator
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Cluster Manager CLI
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift distributed tracing 3
Red Hat OpenShift for Windows Containers
Red Hat OpenShift GitOps
Red Hat OpenShift Virtualization 4

Not affected:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
Cryostat 4 on RHEL 9
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Cluster Observability Operator 1.5.0
Logging Subsystem for Red Hat OpenShift 6.6
OpenShift API for Data Protection 1.5
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13

Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334 See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 https://access.redhat.com/errata/RHSA-2026:68335 Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333

Package advisory (CVE-2026-41178)

Affected packages:

go.opentelemetry.io/otel/baggage >= 1.41.0, < 1.42.0
go.opentelemetry.io/otel/propagation >= 1.41.0, < 1.42.0
go.opentelemetry.io/otel/baggage >= 1.43.0, < 1.44.0
go.opentelemetry.io/otel/propagation >= 1.43.0, < 1.44.0

Patched in:

go.opentelemetry.io/otel/baggage 1.42.0
go.opentelemetry.io/otel/propagation 1.42.0
go.opentelemetry.io/otel/baggage 1.44.0
go.opentelemetry.io/otel/propagation 1.44.0

Source: https://osv.dev/vulnerability/GHSA-5wrp-cwcj-q835

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026CVSS 5.3 → 7.5
Sep 8, 2026Severity medium → high
Sep 8, 2026CVSS 7.5 → 5.3
Sep 8, 2026Severity high → medium
Sep 8, 2026CVSS 5.3 → 7.5
Sep 8, 2026Severity medium → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed