GCVE - cpe:2.3:a:open-telemetry:opentelemetry-js:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:open-telemetry:opentelemetry-js:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Open Telemetry (`e0933b97-2767-54e8-948d-aac7569a5839`)
Product	Opentelemetry Js (`d0747146-2871-595c-89ad-2ae822543444`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-59892`	vulnerable	2026-07-29 01:03:18.046686	OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header HIGH (7.5) OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0. Published: 2026-07-08T16:03:58.439Z Updated: 2026-07-08T19:41:27.498Z Open on db.gcve.eu Reference links https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88 https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-54285`	vulnerable	2026-07-29 01:00:27.676472	opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation MEDIUM (5.3) opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0. Published: 2026-06-22T16:52:54.233Z Updated: 2026-06-23T16:11:07.708Z Open on db.gcve.eu Reference links https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-44902`	vulnerable	2026-06-08 08:05:11.372947	opentelemetry-js: Prometheus exporter process crash via malformed HTTP request HIGH (7.5) opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0. Published: 2026-05-27T14:49:04.940Z Updated: 2026-05-28T15:26:13.701Z Open on db.gcve.eu Reference links https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.