CVE-2026-29181
High · 7.5CVSS
7.5
EPSS
0.9%
Published
Apr 7, 2026
CISA due date
—
The record
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | etcd | 0 | 3.6.13-1.1 |
Related vulnerabilities
- CVE-2026-39883 OpenTelemetry-Go is the Go implementation of OpenTelemetry. Also affects etcd
- CVE-2021-28235 Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to… Also affects etcd
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770
- CVE-2026-96377 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined… CWE-770
- CVE-2026-96365 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform… CWE-770
- CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource… CWE-770
- CVE-2026-113811 Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory… CWE-770
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-770