CVE-2026-116694 OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116694?
CVE-2026-116694 is a medium-severity vulnerability in open-telemetry opentelemetry-python, published on 27 Oct 2026.
Official description
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. Services that enable the optional Jaeger propagator can perform unnecessary CPU work and short-lived heap allocations when an untrusted carrier supplies numerous or oversized values, contributing to denial of service when transport-level limits do not constrain the input. Common default Python HTTP server limits reduce the practical impact, while custom getters, non-HTTP transports, or raised header limits increase exposure. This issue is fixed in version 1.45.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-116694?
2 open source packages ship an affected version, including opentelemetry-propagator-jaeger.
| Package | Affected | Fixed in |
|---|---|---|
opentelemetry-propagator-jaeger PyPI | All versions | 1.45.0 |
opentelemetry-propagator-jaeger PyPI | All versions | 1.45.0 |
How do I fix CVE-2026-116694?
Upgrade opentelemetry-propagator-jaeger to 1.45.0 or later.
Is CVE-2026-116694 being exploited?
There is no known exploitation of CVE-2026-116694 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-116694, GHSA-f5m9-jfrj-jjj7, UBUNTU-CVE-2026-116694.