--- id: CVE-2026-41178 title: >- github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denia… summary: >- A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length i… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: CWE-770 vendor: Red Hat product: Red Hat Openshift Data Foundation 4.22 affected: - assisted_installer_for_red_hat_openshift_container_platform 2 - builds_for_red_hat_openshift - cert_manager_operator_for_red_hat_openshift - confidential_compute_attestation - cryostat 4 - file_integrity_operator - logging_subsystem_for_red_hat_openshift - migration_toolkit_for_applications 8 - multicluster_engine_for_kubernetes - multicluster_global_hub - openshift_api_for_data_protection - openshift_lightspeed - openshift_pipelines - openshift_serverless - openshift_service_mesh 3 - openshift_source_to_image_s2i - power_monitoring_for_red_hat_openshift - advanced_cluster_management_for_kubernetes 2 - advanced_cluster_security 4 - ceph_storage 5 - ceph_storage 6 - ceph_storage 7 - ceph_storage 8 - ceph_storage 9 - certification_program_for_red_hat_enterprise_linux 9 - connectivity_link 1 - edge_manager 1 - enterprise_linux 10 - enterprise_linux 9 - lightspeed_for_runtimes_operator - openshift_ai_rhoai - openshift_cluster_manager_cli - openshift_container_platform 4 - openshift_dev_spaces - openshift_dev_workspaces_operator - openshift_distributed_tracing 3 - openshift_for_windows_containers - openshift_gitops - openshift_virtualization 4 - openstack_platform 16.2 patched: - rhem_1_1_for_rhel 10 - rhem_1_2_for_rhel 10 - cryostat_4_on_rhel 9 - rhem_1_1_for_rhel 9 - rhem_1_2_for_rhel 9 - enterprise_linux_appstream_eus_v_10_0 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_e4s_v_9_4 - enterprise_linux_appstream_eus_v_9_6 - enterprise_linux_appstream_v_9 - cluster_observability_operator 1.5.0 - logging_subsystem_for_red_hat_openshift 6.6 - openshift_api_for_data_protection 1.5 - advanced_cluster_management_for_kubernetes 2.11 - advanced_cluster_management_for_kubernetes 2.13 - advanced_cluster_management_for_kubernetes 2.14 - advanced_cluster_management_for_kubernetes 2.15 - advanced_cluster_management_for_kubernetes 2.16 - advanced_cluster_management_for_kubernetes 2.17 - developer_hub 1.10 - openshift_ai 2.25 - openshift_service_mesh 3.4 - openshift_distributed_tracing 3.10.2 - openshift_distributed_tracing 3.11.1 - openshift_data_foundation 4.22 - external_secrets_operator_for_red_hat_openshift 1.2 published: '2026-06-04' updated: '2026-09-20' sourceUpdated: '2026-09-20T16:34:04+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41178.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41178.json - url: 'https://access.redhat.com/security/cve/CVE-2026-41178' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2484830' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-41178' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-41178' - url: 'https://github.com/open-telemetry/opentelemetry-go/pull/7880' - url: >- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835 - url: 'https://access.redhat.com/errata/RHSA-2026:68334' - url: 'https://access.redhat.com/errata/RHSA-2026:68335' - url: 'https://access.redhat.com/errata/RHSA-2026:68333' - url: 'https://access.redhat.com/errata/RHSA-2026:67974' - url: 'https://access.redhat.com/errata/RHSA-2026:66327' - url: 'https://access.redhat.com/errata/RHSA-2026:67139' - url: 'https://access.redhat.com/errata/RHSA-2026:65116' - url: 'https://access.redhat.com/errata/RHSA-2026:66432' - url: 'https://access.redhat.com/errata/RHSA-2026:67148' - url: 'https://access.redhat.com/errata/RHSA-2026:68527' - url: 'https://access.redhat.com/errata/RHSA-2026:65336' - url: 'https://access.redhat.com/errata/RHSA-2026:67975' - url: 'https://access.redhat.com/errata/RHSA-2026:67138' - url: 'https://access.redhat.com/errata/RHSA-2026:65117' - url: 'https://access.redhat.com/errata/RHSA-2026:61314' - url: 'https://access.redhat.com/errata/RHSA-2026:66521' - url: 'https://access.redhat.com/errata/RHSA-2026:66022' - url: 'https://access.redhat.com/errata/RHSA-2026:60387' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:60389' - url: 'https://access.redhat.com/errata/RHSA-2026:60391' - url: 'https://access.redhat.com/errata/RHSA-2026:63016' - url: 'https://access.redhat.com/errata/RHSA-2026:62851' - url: 'https://access.redhat.com/errata/RHSA-2026:65126' - url: 'https://access.redhat.com/errata/RHSA-2026:59583' - url: 'https://access.redhat.com/errata/RHSA-2026:54773' - url: 'https://access.redhat.com/errata/RHSA-2026:65343' - url: 'https://access.redhat.com/errata/RHSA-2026:65130' - url: 'https://access.redhat.com/errata/RHSA-2026:66363' - url: 'https://github.com/open-telemetry/opentelemetry-go' tags: - csaf - vex - red-hat - osv - go epss: 0.00336 epssPercentile: 0.2427 aliases: - GHSA-5wrp-cwcj-q835 - GO-2026-5158 ecosystem: go ingestedAt: '2026-07-25T19:08:11.062Z' --- ## Overview A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs. ## Vendor advisories - **RHSA-2026:68334** · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68334) - **RHSA-2026:68335** · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68335) - **RHSA-2026:68333** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68333) - **RHSA-2026:67974** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:67974) - **RHSA-2026:66327** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66327) - **RHSA-2026:67139** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67139) - **RHSA-2026:65116** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65116) - **RHSA-2026:66432** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:66432) - **RHSA-2026:67148** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67148) - **RHSA-2026:68527** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:68527) - **RHSA-2026:65336** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65336) - **Red Hat VEX** · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Cryostat 4, File Integrity Operator, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Multicluster Engine for Kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, … · updated 2026-09-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-41178.json) - **RHSA-2026:67138** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67138) - **RHSA-2026:65117** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65117) - **RHSA-2026:61314** · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61314) - **RHSA-2026:66521** · Red Hat · fixed in: Logging Subsystem for Red Hat OpenShift 6.6 · released 2026-09-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:66521) - **RHSA-2026:66022** · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66022) - **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387) - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:60389** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60389) - **RHSA-2026:60391** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60391) - **RHSA-2026:63016** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63016) - **RHSA-2026:62851** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-09-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:62851) - **RHSA-2026:59583** · Red Hat · fixed in: Red Hat OpenShift Service Mesh 3.4 · released 2026-08-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:59583) **github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers** — rated Important by Red Hat. Released 2026-06-04, updated 2026-09-20. Affected: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Builds for Red Hat OpenShift - cert-manager Operator for Red Hat OpenShift - Confidential Compute Attestation - Cryostat 4 - File Integrity Operator - Logging Subsystem for Red Hat OpenShift - Migration Toolkit for Applications 8 - Multicluster Engine for Kubernetes - Multicluster Global Hub - OpenShift API for Data Protection - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 3 - OpenShift Source-to-Image (S2I) - Power monitoring for Red Hat OpenShift - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat Ceph Storage 5 - Red Hat Ceph Storage 6 - Red Hat Ceph Storage 7 - Red Hat Ceph Storage 8 - Red Hat Ceph Storage 9 - Red Hat Certification Program for Red Hat Enterprise Linux 9 - Red Hat Connectivity Link 1 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 9 - Red Hat Lightspeed for Runtimes Operator - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Cluster Manager CLI - Red Hat OpenShift Container Platform 4 - Red Hat OpenShift Dev Spaces - Red Hat OpenShift Dev Workspaces Operator - Red Hat OpenShift distributed tracing 3 - Red Hat OpenShift for Windows Containers - Red Hat OpenShift GitOps - Red Hat OpenShift Virtualization 4 - Red Hat OpenStack Platform 16.2 Fixed: - RHEM 1.1 for RHEL 10 - RHEM 1.2 for RHEL 10 - Cryostat 4 on RHEL 9 - RHEM 1.1 for RHEL 9 - RHEM 1.2 for RHEL 9 - Red Hat Enterprise Linux AppStream EUS (v. 10.0) - Red Hat Enterprise Linux AppStream (v. 10) - Red Hat Enterprise Linux AppStream (v. 8) - Red Hat Enterprise Linux AppStream E4S (v.9.4) - Red Hat Enterprise Linux AppStream EUS (v.9.6) - Red Hat Enterprise Linux AppStream (v. 9) - Cluster Observability Operator 1.5.0 - Logging Subsystem for Red Hat OpenShift 6.6 - OpenShift API for Data Protection 1.5 - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 - Red Hat Advanced Cluster Management for Kubernetes 2.14 - Red Hat Advanced Cluster Management for Kubernetes 2.15 - Red Hat Advanced Cluster Management for Kubernetes 2.16 - Red Hat Advanced Cluster Management for Kubernetes 2.17 - Red Hat Developer Hub 1.10 - Red Hat OpenShift AI 2.25 - Red Hat OpenShift Service Mesh 3.4 - Red Hat OpenShift distributed tracing 3.10.2 - Red Hat OpenShift distributed tracing 3.11.1 - Red Hat Openshift Data Foundation 4.22 - external secrets operator for Red Hat OpenShift 1.2 No fix planned: - Assisted Installer for Red Hat OpenShift Container Platform 2 - Multicluster Engine for Kubernetes - Red Hat Advanced Cluster Management for Kubernetes 2 - Red Hat Advanced Cluster Security 4 - Red Hat OpenShift Container Platform 4 - Zero Trust Workload Identity Manager - Tech Preview - Red Hat Ceph Storage 5 - Red Hat Ceph Storage 6 - Red Hat Ceph Storage 7 - Red Hat Ceph Storage 8 - Red Hat Ceph Storage 9 - Builds for Red Hat OpenShift - cert-manager Operator for Red Hat OpenShift - Confidential Compute Attestation - Cryostat 4 - File Integrity Operator - Logging Subsystem for Red Hat OpenShift - Migration Toolkit for Applications 8 - Multicluster Global Hub - OpenShift API for Data Protection - OpenShift Lightspeed - OpenShift Pipelines - OpenShift Serverless - OpenShift Service Mesh 3 - OpenShift Source-to-Image (S2I) - Power monitoring for Red Hat OpenShift - Red Hat Certification Program for Red Hat Enterprise Linux 9 - Red Hat Connectivity Link 1 - Red Hat Edge Manager 1 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 9 - Red Hat Lightspeed for Runtimes Operator - Red Hat OpenShift AI (RHOAI) - Red Hat OpenShift Cluster Manager CLI - Red Hat OpenShift Dev Spaces - Red Hat OpenShift Dev Workspaces Operator - Red Hat OpenShift distributed tracing 3 - Red Hat OpenShift for Windows Containers - Red Hat OpenShift GitOps - Red Hat OpenShift Virtualization 4 Not affected: - RHEM 1.1 for RHEL 10 - RHEM 1.2 for RHEL 10 - Cryostat 4 on RHEL 9 - RHEM 1.1 for RHEL 9 - RHEM 1.2 for RHEL 9 - Cluster Observability Operator 1.5.0 - Logging Subsystem for Red Hat OpenShift 6.6 - OpenShift API for Data Protection 1.5 - Red Hat Advanced Cluster Management for Kubernetes 2.11 - Red Hat Advanced Cluster Management for Kubernetes 2.13 ## Remediation See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334 See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 https://access.redhat.com/errata/RHSA-2026:68335 Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:68333 ## Package advisory (CVE-2026-41178) Affected packages: - `go.opentelemetry.io/otel/baggage >= 1.41.0, < 1.42.0` - `go.opentelemetry.io/otel/propagation >= 1.41.0, < 1.42.0` - `go.opentelemetry.io/otel/baggage >= 1.43.0, < 1.44.0` - `go.opentelemetry.io/otel/propagation >= 1.43.0, < 1.44.0` Patched in: - `go.opentelemetry.io/otel/baggage 1.42.0` - `go.opentelemetry.io/otel/propagation 1.42.0` - `go.opentelemetry.io/otel/baggage 1.44.0` - `go.opentelemetry.io/otel/propagation 1.44.0` Source: https://osv.dev/vulnerability/GHSA-5wrp-cwcj-q835