CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
Attackers can cause denial of service via unbounded memory allocation in OpenTelemetry Java baggage propagation, affecting all services using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45292?
CVE-2026-45292 is a medium-severity denial of service vulnerability in io.opentelemetry opentelemetry-api, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Weakness: CWE-770
Which versions are affected by CVE-2026-45292?
4 open source packages ship an affected version, including io.opentelemetry:opentelemetry-api and io.opentelemetry:opentelemetry-extension-trace-propagators.
| Package | Affected | Fixed in |
|---|---|---|
io.opentelemetry:opentelemetry-api Maven | All versions | 1.62.0 |
io.opentelemetry:opentelemetry-api Maven | All versions | 1.62.0 |
io.opentelemetry:opentelemetry-extension-trace-propagators Maven | All versions | 1.62.0 |
io.opentelemetry:opentelemetry-extension-trace-propagators Maven | All versions | 1.62.0 |
How do I fix CVE-2026-45292?
Upgrade io.opentelemetry:opentelemetry-api to 1.62.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45292 being exploited?
There is no known exploitation of CVE-2026-45292 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-EN44130, CLEANSTART-2026-HN10923, CLEANSTART-2026-IX22317, CLEANSTART-2026-NF34256, CLEANSTART-2026-VX30218, CLSA-2026-1792053312 and 5 more.