Security fix · CVE-2026-116694
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Published Oct 27, 2026 · catalog updated Oct 27, 2026 · OpenTelemetry Python: Unbounded memory
Last checked Nov 3, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116694. EPSS is 0.38%. Act only if a listed version of OpenTelemetry Python: Unbounded memory is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (OpenTelemetry Python: Unbounded memory).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- Medium—
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.38%
- Remediation
- Version ranges on file
- Affected products
- PyPI opentelemetry-propagator-jaeger · pip opentelemetry-propagator-jaeger · pypi opentelemetry-propagator-jaeger
## Summary in did not enforce limits when extracting inbound baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept. ## Impact Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator: - Gunicorn allows a maximum of 100 request-header fields and 8,190 bytes per field by default. - Uvicorn’s h11 implementation limits its incomplete-event buffer to 16,384 bytes by default. The risk is higher for non-HTTP transports, custom implementations, or deployments where server and gateway limits have been increased or disabled. The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. ## Patches Versions of earlier than are affected. Upgrade to version or later. Version limits extraction to 180 entries and 8,192 total bytes and skips entries larger than 4,096 bytes. ## Credit tonghuaroot
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- PyPI opentelemetry-propagator-jaeger0 → 1.45.0
- pip opentelemetry-propagator-jaeger<= 1.44.0
- pypi opentelemetry-propagator-jaegerversion unspecified
How to fix CVE-2026-116694
Upgrade
CVE-2026-116694 lists a fix boundary at 1.45.0. Compare the installed build with that boundary before you change production.
Version check
Affected <= 1.44.0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116694. EPSS is 0.38%. Act only if a listed version of OpenTelemetry Python: Unbounded memory is installed.
Which versions are affected?
Compare what you have installed with 0 → 1.45.0, <= 1.44.0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-770: Allocation of Resources Without Limits or Throttling. EPSS 0.38%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 27, 2026 · GitHub Advisory Database
Detected
## Summary in did not enforce limits when extracting inbound baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept. ## Impact Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. Th
Oct 27, 2026 · GitHub Advisory Database
Updated
## Summary in did not enforce limits when extracting inbound baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept. ## Impact Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. Th
Oct 27, 2026 · PyPA Advisory Database
Fix available
opentelemetry-propagator-jaeger fixed in 1.45.0
Oct 27, 2026 · PyPA Advisory Database
Fix available
opentelemetry-propagator-jaeger fixed in 1.45.0
Oct 27, 2026 · PyPA Advisory Database
Updated
## Summary in did not enforce limits when extracting inbound baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept. ## Impact Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. Th
Sources
- CVE.orgVulnerability recordCVE-2026-116694
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-116694
30-day exploitation probability 0.38%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-f5m9-jfrj-jjj7
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116694
JaegerPropagator.extract() in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx-* baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept.
advisories.gitlab.com - PyPA Advisory DatabasePackage advisoryGHSA-f5m9-jfrj-jjj7
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
osv.dev
References
Freshness
Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 3, 2026
- CVE.orgOct 28, 2026
- PyPA Advisory DatabaseOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026
- GitHub Advisory DatabaseOct 28, 2026