CVE-2026-45292 - Medium Severity Vulnerability
Vulnerable Library - opentelemetry-api-1.41.0.jar
OpenTelemetry API
Library home page: https://github.com/open-telemetry/opentelemetry-java
Path to dependency file: /OPENAPI-REST-API/openapi-client/kotlin/build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.opentelemetry/opentelemetry-api/1.41.0/ec5ad3b420c9fba4b340e85a3199fd0f2accd023/opentelemetry-api-1.41.0.jar
Dependency Hierarchy:
- swift-export-embeddable-2.2.20.jar (Root Library)
- ❌ opentelemetry-api-1.41.0.jar (Vulnerable Library)
Found in HEAD commit: 1f70e2feccb7006c8d32cc7d4fe62f5cf5e5c34d
Found in base branch: master
Vulnerability Details
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Publish Date: 2026-05-28
URL: CVE-2026-45292
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: GHSA-rcgg-9c38-7xpx
Release Date: 2026-05-16
Fix Resolution: https://github.com/open-telemetry/opentelemetry-java.git - v1.62.0,io.opentelemetry:opentelemetry-extension-trace-propagators:1.62.0
Step up your Open Source Security Game with Mend here
CVE-2026-45292 - Medium Severity Vulnerability
OpenTelemetry API
Library home page: https://github.com/open-telemetry/opentelemetry-java
Path to dependency file: /OPENAPI-REST-API/openapi-client/kotlin/build.gradle
Path to vulnerable library: /tmp/containerbase/cache/.gradle/caches/modules-2/files-2.1/io.opentelemetry/opentelemetry-api/1.41.0/ec5ad3b420c9fba4b340e85a3199fd0f2accd023/opentelemetry-api-1.41.0.jar
Dependency Hierarchy:
Found in HEAD commit: 1f70e2feccb7006c8d32cc7d4fe62f5cf5e5c34d
Found in base branch: master
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Publish Date: 2026-05-28
URL: CVE-2026-45292
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: GHSA-rcgg-9c38-7xpx
Release Date: 2026-05-16
Fix Resolution: https://github.com/open-telemetry/opentelemetry-java.git - v1.62.0,io.opentelemetry:opentelemetry-extension-trace-propagators:1.62.0
Step up your Open Source Security Game with Mend here