CVE-2026-54285

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf	Vendor Advisory Mitigation

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:node.js:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) opentelemetry-js es el cliente JavaScript de OpenTelemetry. Antes de la versión 2.8.0, W3CBaggagePropagator.extract() en @opentelemetry/core no aplica límites de tamaño al analizar los encabezados HTTP de baggage entrantes. La especificación W3C Baggage recomienda un máximo de 8.192 bytes y 180 entradas; estos límites solo se aplicaban en la ruta de salida (inject()), no en la ruta de entrada (extract()). El análisis de baggage de tamaño excesivo causa una asignación de memoria proporcional al tamaño del encabezado sin ningún límite. Esta vulnerabilidad se corrige en la versión 2.8.0.

Information

Published : 2026-06-22 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-54285

Mitre link : CVE-2026-54285

CVE.ORG link : CVE-2026-54285

JSON object : View

Products Affected

opentelemetry

opentelemetry

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-54285", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54285", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T14:48:29.048253Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-js", "versions": [{"status": "affected", "version": "< 2.8.0"}]}]}], "published": "2026-06-22T18:16:47.077", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf", "tags": ["Vendor Advisory", "Mitigation"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0."}, {"lang": "es", "value": "opentelemetry-js es el cliente JavaScript de OpenTelemetry. Antes de la versi\u00f3n 2.8.0, W3CBaggagePropagator.extract() en @opentelemetry/core no aplica l\u00edmites de tama\u00f1o al analizar los encabezados HTTP de baggage entrantes. La especificaci\u00f3n W3C Baggage recomienda un m\u00e1ximo de 8.192 bytes y 180 entradas; estos l\u00edmites solo se aplicaban en la ruta de salida (inject()), no en la ruta de entrada (extract()). El an\u00e1lisis de baggage de tama\u00f1o excesivo causa una asignaci\u00f3n de memoria proporcional al tama\u00f1o del encabezado sin ning\u00fan l\u00edmite. Esta vulnerabilidad se corrige en la versi\u00f3n 2.8.0."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "21AAAFA3-4F91-44D4-AC0C-A56BA5ED8816", "versionEndExcluding": "2.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}