1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
opentelemetry-core
Ecosystem: npm
Downloads: 682.42 Mln
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting opentelemetry-core, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-8988-4f7v-96qf | Moderate | OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation## Overview `W3CBaggagePropagator.extract()` in `@opentelemetry/core` does not enforce size limits when parsing inbound `baggage` HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (`inject()`) path, not on the inbound (`extract()`) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. ## Impact The practical availability impact for most Node.js deployments is limited. Node.js enforces a default `--max-http-header-size` of 16,384 bytes on the tota |
| GitHub (opens in a new tab) |
- GHSA-8988-4f7v-96qfModerateOpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
< 2.8.0
## Overview `W3CBaggagePropagator.extract()` in `@opentelemetry/core` does not enforce size limits when parsing inbound `baggage` HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (`inject()`) path, not on the inbound (`extract()`) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. ## Impact The practical availability impact for most Node.js deployments is limited. Node.js enforces a default `--max-http-header-size` of 16,384 bytes on the tota
CVE: CVE-2026-54285