CVE-2026-116694
Description
A flaw was found in opentelemetry-propagator-jaeger. A remote attacker could trigger a Denial of Service (DoS) by sending requests containing numerous or oversized baggage header values. Because the inbound values are processed without limits on entry count or total byte size, the application consumes excessive processing power and memory, leading to service degradation or unresponsiveness.
Statement
This vulnerability is rated as having a Moderate impact for Red Hat products because exploitation requires the optional Jaeger propagator to be explicitly enabled and exposed to untrusted input without transport-level header constraints. By default, OpenTelemetry configurations do not use the Jaeger propagator, and standard Python web servers or ingress proxies enforce request header size limits that substantially restrict the potential for denial of service. The risk is primarily confined to non-default deployments utilizing custom carrier getters, non-HTTP transports, or environments with relaxed header limits where unbounded memory and CPU consumption could lead to service degradation.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
