Back to overview

CVE-2026-54285

MEDIUM
5.3
CVSS 3.1
Description
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.

Metadata

CVE ID
CVE-2026-54285
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-12 17:46 UTC
Published
2026-06-22 16:52 UTC
Last updated
2026-06-22 16:52 UTC
Primary CWE
CWE-770
CWE-770: Allocation of Resources Without Limits or Throttlin…
Vendor / Product
open-telemetry / opentelemetry-js
Sources
cve.org  ·  NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products (1)
VendorProductPlatformVersions
open-telemetry opentelemetry-js — < 2.8.0
Weakness (CWE)
CWESourceDescription
CWE-770 cna CWE-770: Allocation of Resources Without Limits or Throttling
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.3 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References (1)
Back to overview