CVE-2026-45292: OpenTelemetry Java Baggage DoS Vulnerability – Patch & Detection Guide

Technical summary

The vulnerability resides in the baggage propagation implementation within opentelemetry-api and opentelemetry-extension-trace-propagators (versions prior to 1.62.0). The baggage parser fails to enforce limits on allocation size, permitting an unauthenticated remote attacker to craft oversized baggage headers that trigger unbounded memory and CPU consumption. The propagation mechanism automatically injects baggage into outgoing requests, causing affected services to re-transmit the malicious payload downstream, amplifying the attack's scope across service meshes without requiring direct exploitation of each target.

Business impact

This vulnerability creates a cascading denial-of-service risk in microservices environments. An attacker targeting a single ingress point can degrade or exhaust resources across multiple dependent services simultaneously. For organizations relying on OpenTelemetry for observability in production systems, this can manifest as latency spikes, service unavailability, or customer-facing outages. The fanout effect is particularly dangerous in high-scale deployments where baggage propagation touches dozens of services, multiplying remediation complexity.

Affected systems

Any application using OpenTelemetry Java (opentelemetry-api or opentelemetry-extension-trace-propagators) in versions prior to 1.62.0 is vulnerable. This includes services instrumented for distributed tracing, especially those deployed in containerized or Kubernetes environments where automatic baggage propagation is standard practice. Java microservices, Spring Boot applications, Quarkus services, and other frameworks that integrate OpenTelemetry for telemetry collection are at risk if not updated.

Exploitability

Exploitation requires no authentication or special privileges. An attacker only needs to craft an HTTP request with a maliciously oversized baggage header and send it to any exposed service running vulnerable OpenTelemetry versions. The attack is trivial to execute and can be launched remotely over the network. No user interaction or complex preconditions are required. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects this low barrier to exploitation.

Remediation

Upgrade opentelemetry-api and opentelemetry-extension-trace-propagators to version 1.62.0 or later. This release includes fixes that enforce proper size limits on baggage parsing, preventing unbounded allocation. Organizations should prioritize upgrades in environments where OpenTelemetry is actively instrumented for tracing, particularly those exposed to untrusted network traffic.

Patch guidance

Update your OpenTelemetry Java dependencies to 1.62.0 or newer. If using a dependency management tool (Maven, Gradle, etc.), update the version constraint in your build file and rebuild all affected services. For containerized deployments, rebuild container images with the patched libraries and perform a controlled rolling update to minimize service disruption. Test in a staging environment first to ensure compatibility with your instrumentation setup and downstream telemetry collectors. Verify that trace propagation continues to function correctly after patching.

Detection guidance

Monitor for HTTP requests with unusually large baggage header values (typically transmitted as W3C Baggage or other standardized headers). Set alerting on application memory usage spikes or CPU consumption increases that correlate with requests from external sources. Observe logs for repeated allocations or parsing warnings related to baggage processing. Network-level detection can flag requests with oversized custom headers targeting baggage fields. Inspect access logs for patterns of requests with abnormally large trace or baggage metadata.

Why prioritize this

Although the CVSS score is moderate (5.3), the practical risk is elevated due to the effortless exploitability, the lack of authentication requirements, and the fanout effect across your service dependencies. In multi-tier architectures, a single malicious request can cascade into resource exhaustion across many systems, making this a significant operational risk despite the absence of confidentiality or integrity impact. Patch deployment should be prioritized for any service exposed to the internet or untrusted networks.

Risk score, explained

The CVSS score of 5.3 reflects a network-accessible vulnerability with low attack complexity and no privilege or user interaction requirements (AV:N/AC:L/PR:N/UI:N), resulting in denial of service impact (A:L). The score does not capture the propagation amplification factor inherent to distributed tracing systems, which security teams should factor into their risk assessment independently. While not critical, the ease of exploitation and broad blast radius in microservices environments warrant urgent attention.

Frequently asked questions