OpenTelemetry-Go's baggage parsing no longer caps raw header length

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-41178 · CVE overview and exploitation status

EUVD-2026-34288

GHSA-5wrp-cwcj-q835

GO-2026-5158

cve-program · CVE-2026-41178

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://github.com/open-telemetry/opentelemetry-go/pull/7880

euvd · EUVD-2026-34288

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://github.com/open-telemetry/opentelemetry-go/pull/7880

nvd · CVE-2026-41178

• https://github.com/open-telemetry/opentelemetry-go/pull/7880
• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835

osv · GHSA-5wrp-cwcj-q835

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://nvd.nist.gov/vuln/detail/CVE-2026-41178
• https://github.com/open-telemetry/opentelemetry-go/pull/7880
• https://github.com/open-telemetry/opentelemetry-go

osv · GO-2026-5158

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
• https://github.com/open-telemetry/opentelemetry-go/pull/7880

• OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs… · Advisory content revised · 15 Nov 2026
• OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs… · Advisory content revised · 7 Nov 2026
• OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs… · Advisory content revised · 1 Nov 2026
• OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs… · Advisory content revised · 30 Oct 2026