Description
W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path.
Recommendation
Update the @opentelemetry/core package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.8.0
- Patched version(s): 2.8.0
References
Could your website be exposed too?
SmartScanner can check your website for OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
- Uncontrolled memory allocation via crafted SVG dimensions in @dicebear/converter - CVE-2026-29112
- Cube Core is vulnerable to privilege escalation via a specially crafted request - CVE-2026-25958
- @rvf/set-get has a prototype pollution issue that's reachable via @rvf/core preprocessFormData (HTTP form data) - CVE-2026-44483
You might also like:
See something that needs correcting? Let us knowUpdated June 15, 2026