CVE-2026-29181

CVE-2026-29181 is a resource exhaustion vulnerability affecting OpenTelemetry-Go versions 1.36.0 through 1.40.0. The flaw exists in the baggage header extraction mechanism, which parses multiple header fields independently and aggregates their contents. An attacker can exploit this by sending numerous baggage header lines to bypass individual value limits and trigger excessive CPU consumption and memory allocation on the target system. The vulnerability has been remediated in version 1.41.0. The vulnerability carries a HIGH severity rating with a CVSS v3.1 score of 7.5. It requires no authentication or user interaction, can be exploited remotely over the network, and has a low attack complexity. The impact is limited to availability; there is no exposure of confidential information or data integrity compromise. However, the ability to exhaust system resources through relatively simple means poses a significant denial-of-service risk to affected deployments. There is currently no evidence of active exploitation in the wild, and the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is widely available, and community attention remains limited as indicated by its inactive status on vulnerability tracking hot lists. Organizations should nevertheless prioritize upgrading to version 1.41.0 to eliminate exposure, particularly in production environments where service availability is critical.