Opentelemetry Rust
Approved changes feed: RSS · Atom
cpe:2.3:a:open-telemetry:opentelemetry-rust:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Open Telemetry (e0933b97-2767-54e8-948d-aac7569a5839) |
|---|---|
| Product | Opentelemetry Rust (e5145598-460d-5e62-977b-1993ee7c5933) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48504 |
vulnerable | 2026-07-29 00:55:01.366487 |
OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation
MEDIUM (5.3)
OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.
Published: 2026-07-17T20:13:45.686Z
Updated: 2026-07-20T15:18:22.372Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.