PT-2026-41161 · Red Hat+5 · Exploit Intelligence+28

August829 · CVE-2026-45292 · Published 2026-05-14 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions opentelemetry-java versions prior to 1.62.0

Description A flaw in the baggage propagation implementation within opentelemetry-api and opentelemetry-extension-trace-propagators allows for unbounded memory allocation and CPU consumption when parsing oversized baggage. This occurs because the W3CBaggagePropagator, JaegerPropagator, and OtTracePropator did not enforce limits on the total size or entry count of the baggage header, iterating through values regardless of length. Since baggage is automatically re-injected into outgoing requests, the impact can spread to downstream services. The risk is increased in environments where transport-layer limits are absent, such as compromised internal services using non-HTTP or custom transports.

Recommendations Update to version 1.62.0 or later. Ensure HTTP header size limits are configured at the server or gateway level.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-45292

GHSA-RCGG-9C38-7XPX

Affected Products

Exploit Intelligence

Migration Toolkit For Applications 8

Migration Toolkit For Containers

Openshift Lightspeed

Openshift Serverless

Red Hat 3Scale Api Management Platform 2

Red Hat Ai Inference Server

Red Hat Ansible Automation Platform 2

Red Hat Data Grid 8

Red Hat Data Grid 8.6.2

Red Hat Enterprise Linux Ai (Rhel Ai) 3

Red Hat Jboss Enterprise Application Platform Expansion Pack

Red Hat Migration Toolkit For Applications 8.2

Red Hat Offline Knowledge Portal 1.2.3

Red Hat Offline Knowledge Portal 1.2.4

Red Hat Offline Knowledge Portal 1.2.6

Red Hat Offline Knowledge Portal 1.2.7

Red Hat Offline Knowledge Portal 1.2.9

Red Hat Openshift

Red Hat Openshift Dev Spaces

Red Hat Openshift Dev Spaces 3.29

Red Hat Quay 3

Red Hat Satellite 6

Io.Opentelemetry:Opentelemetry-Api

Io.Opentelemetry:Opentelemetry-Extension-Trace-Propagators

Io.Root.Io.Opentelemetry:Opentelemetry-Api

Opentelemetry Api

Opentelemetry-Extension-Trace-Propagators

Opentelemetry-Java

References · 22

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45292.json · Exploit
• https://access.redhat.com/errata/RHSA-2026:41951 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-45292 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:28573 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:36820 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:43038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45292 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2026-45292 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rcgg-9c38-7xpx · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-java/pull/8380 · Note
• https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f · Note
• https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx · Note
• https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0 · Note
• https://github.com/open-telemetry/opentelemetry-java · Note
• https://t.me/cveNotify/184540 · Telegram Post