CVE-2026-116694 in Python
Summary
by MITRE • 10/27/2026
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within OpenTelemetry Python prior to version 1.45.0 centers on a lack of input validation and resource management controls in the JaegerPropagator.extract() method, specifically regarding the handling of uberctx- baggage values. As an open-source observability framework, OpenTelemetry is designed to collect telemetry data such as traces, metrics, and logs from distributed systems. The propagators within this ecosystem are responsible for injecting context into outgoing requests and extracting it from incoming ones, ensuring that trace continuity is maintained across service boundaries. In the affected versions, the JaegerPropagator failed to enforce limits on the number of entries, the size of individual entry bytes, or the total byte count when processing inbound baggage data carried in headers like uberctx-. This absence of constraints allows an attacker who can control the input carrier to supply a maliciously crafted set of header values that trigger excessive computational overhead and memory allocation within the Python runtime.
From a technical perspective, this flaw constitutes a resource exhaustion vulnerability where untrusted input leads to disproportionate consumption of system resources. When services enable the optional Jaeger propagator, they become susceptible to denial-of-service conditions if an external actor supplies numerous or oversized uberctx-* values. The processing logic iterates through these values without checking for size limits, leading to short-lived heap allocations that accumulate rapidly under high-volume attack scenarios. While common default configurations in Python HTTP servers often impose header size limits that mitigate the practical impact of this vulnerability in standard web deployments, the risk escalates significantly when custom getters are used or when non-HTTP transports such as gRPC or message queues are employed. In these environments, transport-level constraints may be absent or configured with higher thresholds, thereby increasing the exposure surface for attackers aiming to degrade service availability through CPU saturation and memory pressure.
The operational impact of this vulnerability is primarily a denial-of-service condition affecting the stability and performance of services that rely on OpenTelemetry tracing with Jaeger propagation enabled. By forcing the application to perform unnecessary CPU work and allocate excessive heap space, an attacker can effectively stall request processing threads or exhaust available memory resources. This degradation in service quality can lead to increased latency for legitimate users, potential crashes due to out-of-memory errors, or complete unavailability of the affected microservice endpoints. The severity is further compounded by the fact that baggage data often carries user-supplied context information, making it a plausible vector for automated attacks targeting observability infrastructure components that are frequently exposed to external traffic.
To mitigate this risk, organizations must upgrade their OpenTelemetry Python dependencies to version 1.45.0 or later, where the JaegerPropagator has been patched to enforce strict limits on entry counts and byte sizes during extraction. For environments unable to immediately patch, defensive measures should include implementing robust input validation at the transport layer, such as configuring HTTP servers to reject headers exceeding specific size thresholds. Additionally, reviewing custom propagators or getters for similar lack of bounds checking is recommended. Aligning with industry standards, this vulnerability maps to CWE-787: Out-of-bounds Write in terms of memory management implications and CWE-400: Uncontrolled Resource Consumption regarding the denial-of-service potential. In the context of the MITRE ATT&CK framework, this behavior aligns with T1496: Resource Hijacking, where attackers leverage compromised or vulnerable systems to consume resources for disruptive purposes rather than data exfiltration or persistence.