CVE-2026-48504 Overview
CVE-2026-48504 affects the OpenTelemetry Rust implementation through version 0.32.0. The BaggagePropagator::extract_with_context function in opentelemetry_sdk fails to enforce W3C Baggage size limits before parsing inbound baggage headers. Attackers can send oversized baggage headers to trigger unnecessary CPU work and short-lived heap allocations during parsing. The SDK later discards these entries due to internal storage limits, but the parsing cost has already been incurred. Services accepting untrusted inbound propagation headers experience increased per-request resource usage. The issue is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling) and is fixed in version 0.32.1.
Critical Impact
Remote unauthenticated attackers can cause elevated CPU and memory consumption in Rust services using OpenTelemetry propagation, degrading availability under sustained oversized-header traffic.
Affected Products
- OpenTelemetry Rust opentelemetry_sdk versions 0.32.0 and earlier
- Rust services using BaggagePropagator::extract_with_context for inbound propagation
- Downstream applications accepting untrusted W3C Baggage headers
Discovery Timeline
- 2026-07-17 - CVE-2026-48504 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-48504
Vulnerability Analysis
The vulnerability resides in the baggage propagator component of the OpenTelemetry Rust SDK. The W3C Baggage specification defines size limits for baggage headers, including maximum header length and maximum entry counts. The BaggagePropagator::extract_with_context function parses inbound baggage headers before applying these limits. An attacker sends an HTTP request with an oversized baggage header containing many entries. The propagator parses the entire header, allocating short-lived heap memory for each entry. Only after parsing completes does the SDK's baggage storage enforce its limits and discard the excess entries. The wasted work scales with attacker-controlled header size.
Root Cause
The root cause is missing input validation before resource-intensive processing. The parser trusts the caller to supply reasonable input and defers size enforcement to a later stage. This design allows unbounded parsing work despite the SDK ultimately capping stored baggage entries. The bug maps to [CWE-770], where resources are allocated without proper limits.
Attack Vector
Exploitation requires no authentication and no user interaction. An attacker sends HTTP requests with maliciously large baggage headers to any service using the vulnerable propagator. Each request forces the target to allocate and parse baggage entries proportional to the header size. Sustained traffic amplifies CPU consumption and short-lived heap pressure, degrading service responsiveness. The attack vector is network-based and works against any endpoint that extracts context from inbound propagation headers.
No public proof-of-concept code has been published. Refer to the GitHub Security Advisory GHSA-w9wp-h8wv-79jx for technical details from the maintainers.
Detection Methods for CVE-2026-48504
Indicators of Compromise
- Inbound HTTP requests containing baggage headers with unusually large payloads or entry counts far exceeding W3C Baggage specification limits
- Sudden CPU utilization spikes on Rust services correlated with elevated inbound request rates
- Increased short-lived heap allocation activity in processes using opentelemetry_sdk version 0.32.0 or earlier
Detection Strategies
- Inspect access logs and reverse proxy telemetry for baggage header sizes exceeding 8192 bytes, the W3C-recommended maximum
- Deploy application-level metrics tracking baggage parsing duration and entry counts per request
- Correlate anomalous latency in tracing middleware with header size distributions across ingress traffic
Monitoring Recommendations
- Enable request-level metrics for header size percentiles on all public-facing Rust services using OpenTelemetry propagation
- Set alerts on sustained CPU utilization increases in services processing inbound trace context
- Audit dependency manifests (Cargo.toml and Cargo.lock) for opentelemetry_sdk versions at or below 0.32.0
How to Mitigate CVE-2026-48504
Immediate Actions Required
- Upgrade opentelemetry_sdk to version 0.32.1 or later across all Rust services
- Enforce baggage header size limits at the ingress layer (reverse proxy, API gateway, or load balancer) before requests reach application code
- Rebuild and redeploy affected services after updating Cargo.lock to pick up the fix
Patch Information
The fix is available in opentelemetry_sdk version 0.32.1. The patch enforces W3C Baggage size limits before parsing inbound headers, preventing wasted allocation and CPU work on oversized inputs. See the GitHub commit a389ca6 for the code change and the GitHub Security Advisory GHSA-w9wp-h8wv-79jx for maintainer guidance.
Workarounds
- Configure ingress components to reject or truncate baggage headers exceeding 8192 bytes before they reach application code
- Apply rate limiting on endpoints accepting untrusted propagation headers to reduce amplification potential
- Strip the baggage header entirely at the edge for services that do not consume distributed baggage context
# Update Cargo.toml to require the patched version
# [dependencies]
# opentelemetry_sdk = ">=0.32.1"
cargo update -p opentelemetry_sdk
cargo build --release
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
