PT-2026-49598 · Npm · @Opentelemetry/Core

Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-54285

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions @opentelemetry/core versions prior to 2.8.0

Description The W3CBaggagePropagator.extract() function in @opentelemetry/core fails to enforce size limits when parsing inbound baggage HTTP headers. While the W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries, these limits were only applied to the outbound inject() path. Consequently, parsing oversized baggage leads to memory allocation proportional to the header size. The risk is increased in deployments where transport-layer limits are absent, such as non-HTTP transports, custom TextMapGetter implementations, or environments where the Node.js --max-http-header-size has been increased.

Recommendations Update to version 2.8.0 or later. Ensure header size limits are configured at the server or gateway level. For non-HTTP transports receiving baggage from untrusted sources, validate input size before passing it to the propagator.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-54285

GHSA-8988-4F7V-96QF

Affected Products

@Opentelemetry/Core

References · 4

• https://osv.dev/vulnerability/GHSA-8988-4f7v-96qf · Vendor Advisory
• https://github.com/open-telemetry/opentelemetry-js · Note
• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf · Note
• https://twitter.com/dailycve/status/2066670010890657839 · Twitter Post