diranged / oz / 38492700376

36%

push

github

chore(deps): update module go.opentelemetry.io/otel to v1.41.0 [security] (#463)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
|
[go.opentelemetry.io/otel](https://redirect.github.com/open-telemetry/opentelemetry-go)
| `v1.40.0` → `v1.41.0` |
![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel/v1.41.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel/v1.40.0/v1.41.0?slim=true)
|

---

### OpenTelemetry-Go: multi-value `baggage` header extraction causes
excessive allocations (remote dos amplification)
[CVE-2026-29181](https://nvd.nist.gov/vuln/detail/CVE-2026-29181) /
[GHSA-mh2q-q3fh-2475](https://redirect.github.com/advisories/GHSA-mh2q-q3fh-2475)

<details>
<summary>More information</summary>

#### Details
multi-value `baggage:` header extraction parses each header field-value
independently and aggregates members across values. this allows an
attacker to amplify cpu and allocations by sending many `baggage:`
header lines, even when each individual value is within the 8192-byte
per-value parse limit.

##### severity

HIGH (availability / remote request amplification)

##### relevant links

- repository: https://github.com/open-telemetry/opentelemetry-go
- pinned callsite:
https://github.com/open-telemetry/opentelemetry-go/blob/<a class=hub.com/diranged/oz/commit/1ee4a4126dbdd1bc79e9fae072fa488beffac52a">1ee4a4126/propagation/baggage.go#L58

##### vulnerability details

**pins:**
open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a
**as-of:** 2026-02-04
**policy:** direct (no program scope provided)

**callsite:** propagation/baggage.go:58 (`extractMultiBaggage`)
**attacker control:** inbound HTTP request headers (many `baggage`
field-values) → `propagation.HeaderCarrier.Values("baggage")` → repeated
`baggage.Parse` + member aggregation

####... (continued)

1037 of 2888 relevant lines covered (35.91%)

1.58 hits per line