CVE catalog

CVE-2026-41178

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log e

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-opentelemetry-otelsid1.46.0-3fixed
Debiangolang-opentelemetry-otelforky1.46.0-2fixed
Debiangolang-opentelemetry-oteltrixie1.31.0-4vulnerable
Debiangolang-opentelemetry-otelbookworm1.1.0-2vulnerable
Cpegolang-opentelemetry-otelNot reportedNot reportedvulnerable
CpeopentelemetryNot reported1.42.0fixed
CpeopentelemetryNot reportedNot reportedunknown
Gogo.opentelemetry.io/otelNot reported1.44.0fixed
Gogo.opentelemetry.io/otelNot reported1.42.0fixed
Opensuseamazon-ecs-inittumbleweed1.107.0-1.1fixed
Susegoogle-osconfig-agentlinux micro 6.120260911.00-slfo.1.1_1.1fixed
Susegoogle-cloud-sap-agentlinux enterprise server 16.03.15-160000.3.1fixed
Susegoogle-cloud-sap-agentlinux enterprise server for sap applications 16.03.15-160000.3.1fixed
Susemcphostlinux enterprise server 16.00.34.0-160000.4.1fixed
Susemcphostlinux enterprise server for sap applications 16.00.34.0-160000.4.1fixed
Susegoogle-osconfig-agentlinux micro 6.020260911.00-1.1fixed
Opensusegoogle-osconfig-agentleap 16.020260911.00-160000.1.1fixed
Susegoogle-osconfig-agentlinux enterprise micro 5.520260911.00-150000.1.67.1fixed
Susegoogle-osconfig-agentlinux enterprise module for public cloud 15 sp420260911.00-150000.1.67.1fixed
Susegoogle-osconfig-agentlinux enterprise module for public cloud 15 sp520260911.00-150000.1.67.1fixed
Susegoogle-osconfig-agentlinux enterprise module for public cloud 15 sp620260911.00-150000.1.67.1fixed
Susegoogle-osconfig-agentlinux enterprise module for public cloud 15 sp720260911.00-150000.1.67.1fixed
Susegoogle-osconfig-agentlinux enterprise module for public cloud 1220260911.00-1.60.1fixed
Opensusegoogle-osconfig-agenttumbleweed20260918.01-1.1fixed
Suseazure-storage-azcopylinux enterprise module for public cloud 15 sp410.32.8-150400.9.21.1fixed
Suseazure-storage-azcopylinux enterprise module for public cloud 15 sp510.32.8-150400.9.21.1fixed
Suseazure-storage-azcopylinux enterprise module for public cloud 15 sp610.32.8-150400.9.21.1fixed
Suseazure-storage-azcopylinux enterprise module for public cloud 15 sp710.32.8-150400.9.21.1fixed
Opensusekubernetes1.35tumbleweed1.35.8-2.1fixed
Opensusekubernetes1.36tumbleweed1.36.4-2.1fixed
Opensusekubernetes1.34tumbleweed1.34.11-2.1fixed
Susemcphostlinux micro 6.20.34.0-160000.4.1fixed
Opensusecontainerized-data-importer1.65tumbleweed1.65.0-3.1fixed
Suseapptainerlinux enterprise module for hpc 15 sp71.5.3-150600.4.40.1fixed
Suseapptainerlinux enterprise module for package hub 15 sp71.5.3-150600.4.40.1fixed
Opensusecontainerized-data-importer1.66tumbleweed1.66.1-1.1fixed
Susegoogle-cloud-sap-agentlinux enterprise module for public cloud 123.15-6.78.1fixed
Susehelmlinux enterprise micro 5.53.21.3-150000.1.93.1fixed
Susehelmlinux enterprise module for containers 15 sp73.21.3-150000.1.93.1fixed
Susehelmlinux enterprise module for package hub 15 sp73.21.3-150000.1.93.1fixed
Susehelmlinux enterprise high performance computing 15 sp4-espos3.21.3-150000.1.93.1fixed
Susehelmlinux enterprise high performance computing 15 sp4-ltss3.21.3-150000.1.93.1fixed
Susehelmlinux enterprise high performance computing 15 sp5-espos3.21.3-150000.1.93.1fixed
Susehelmlinux enterprise high performance computing 15 sp5-ltss3.21.3-150000.1.93.1fixed
Susehelmlinux enterprise server 15 sp4-ltss3.21.3-150000.1.93.1fixed
Susehelmlinux enterprise server 15 sp5-ltss3.21.3-150000.1.93.1fixed
Susehelmlinux enterprise server 15 sp6-ltss3.21.3-150000.1.93.1fixed
Susehelmlinux enterprise server for sap applications 15 sp43.21.3-150000.1.93.1fixed
Susehelmlinux enterprise server for sap applications 15 sp53.21.3-150000.1.93.1fixed
Susehelmlinux enterprise server for sap applications 15 sp63.21.3-150000.1.93.1fixed
Opensuseapptainerleap 16.01.5.3-bp160.3.1fixed
Opensusemcphostleap 16.00.34.0-160000.4.1fixed
Opensusegoogle-cloud-sap-agentleap 16.03.15-160000.3.1fixed
Opensusehelmtumbleweed4.2.4-1.1fixed
Opensuseapptainertumbleweed1.5.3-3.1fixed
Opensusemcphosttumbleweed0.34.0-10.1fixed
Opensusecorednsleap 16.01.14.7-bp160.1.1fixed
Opensusedistributiontumbleweed3.1.1-5.1fixed
Opensusecorednstumbleweed1.14.7-1.1fixed
Opensusehelm3tumbleweed3.21.3-6.1fixed
Opensuseazure-storage-azcopytumbleweed10.32.7-1.1fixed
Opensuseamazon-cloudwatch-agenttumbleweed1.300071.0-2.1fixed
Opensusecadvisortumbleweed0.60.5-2.1fixed
Opensusebuildpacks-clitumbleweed0.40.9-1.1fixed
Opensuseghleap 16.02.102.0-bp160.1.1fixed
Opensuseghtumbleweed2.102.0-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-opentelemetry-otelsourcesid1.46.0-2not yet assignedNot reported[1139167]
Debiangolang-opentelemetry-otelsourceforky1.46.0-2not yet assignedNot reported[1139167]
Debiangolang-opentelemetry-otelsourcetrixie(unfixed)not yet assignedNot reported[1139167]
Debiangolang-opentelemetry-otelsourcebookworm(unfixed)not yet assignedNot reported[1139167]
CpeopentelemetrycpeNot reported1.42.0Not reportedNot reportedNot reported
Gogo.opentelemetry.io/otelGoNot reported1.44.0Not reportedNot reportedNot reported
Gogo.opentelemetry.io/otelGoNot reported1.42.0Not reportedNot reportedNot reported
Opensuseamazon-ecs-initrpmtumbleweed1.107.0-1.1Not reportedOPENSUSE-SU-2026:11914-1Not reported
Susegoogle-osconfig-agentrpmlinux micro 6.120260911.00-slfo.1.1_1.1Not reportedSUSE-SU-2026:23924-1Not reported
Susegoogle-cloud-sap-agentrpmlinux enterprise server 16.03.15-160000.3.1Not reportedSUSE-SU-2026:23619-1Not reported
Susegoogle-cloud-sap-agentrpmlinux enterprise server for sap applications 16.03.15-160000.3.1Not reportedSUSE-SU-2026:23619-1Not reported
Susemcphostrpmlinux enterprise server 16.00.34.0-160000.4.1Not reportedSUSE-SU-2026:23636-1Not reported
Susemcphostrpmlinux enterprise server for sap applications 16.00.34.0-160000.4.1Not reportedSUSE-SU-2026:23636-1Not reported
Susegoogle-osconfig-agentrpmlinux micro 6.020260911.00-1.1Not reportedSUSE-SU-2026:23876-1Not reported
Opensusegoogle-osconfig-agentrpmleap 16.020260911.00-160000.1.1Not reportedOPENSUSE-SU-2026:21882-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise micro 5.520260911.00-150000.1.67.1Not reportedSUSE-SU-2026:4293-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise module for public cloud 15 sp420260911.00-150000.1.67.1Not reportedSUSE-SU-2026:4293-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise module for public cloud 15 sp520260911.00-150000.1.67.1Not reportedSUSE-SU-2026:4293-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise module for public cloud 15 sp620260911.00-150000.1.67.1Not reportedSUSE-SU-2026:4293-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise module for public cloud 15 sp720260911.00-150000.1.67.1Not reportedSUSE-SU-2026:4293-1Not reported
Susegoogle-osconfig-agentrpmlinux enterprise module for public cloud 1220260911.00-1.60.1Not reportedSUSE-SU-2026:4292-1Not reported
Opensusegoogle-osconfig-agentrpmtumbleweed20260918.01-1.1Not reportedOPENSUSE-SU-2026:11847-1Not reported
Suseazure-storage-azcopyrpmlinux enterprise module for public cloud 15 sp410.32.8-150400.9.21.1Not reportedSUSE-SU-2026:4125-1Not reported
Suseazure-storage-azcopyrpmlinux enterprise module for public cloud 15 sp510.32.8-150400.9.21.1Not reportedSUSE-SU-2026:4125-1Not reported
Suseazure-storage-azcopyrpmlinux enterprise module for public cloud 15 sp610.32.8-150400.9.21.1Not reportedSUSE-SU-2026:4125-1Not reported
Suseazure-storage-azcopyrpmlinux enterprise module for public cloud 15 sp710.32.8-150400.9.21.1Not reportedSUSE-SU-2026:4125-1Not reported
Opensusekubernetes1.35rpmtumbleweed1.35.8-2.1Not reportedOPENSUSE-SU-2026:11775-1Not reported
Opensusekubernetes1.36rpmtumbleweed1.36.4-2.1Not reportedOPENSUSE-SU-2026:11776-1Not reported
Opensusekubernetes1.34rpmtumbleweed1.34.11-2.1Not reportedOPENSUSE-SU-2026:11774-1Not reported
Susemcphostrpmlinux micro 6.20.34.0-160000.4.1Not reportedSUSE-SU-2026:23496-1Not reported
Opensusecontainerized-data-importer1.65rpmtumbleweed1.65.0-3.1Not reportedOPENSUSE-SU-2026:11731-1Not reported
Suseapptainerrpmlinux enterprise module for hpc 15 sp71.5.3-150600.4.40.1Not reportedSUSE-SU-2026:3928-1Not reported
Suseapptainerrpmlinux enterprise module for package hub 15 sp71.5.3-150600.4.40.1Not reportedSUSE-SU-2026:3928-1Not reported
Opensusecontainerized-data-importer1.66rpmtumbleweed1.66.1-1.1Not reportedOPENSUSE-SU-2026:11732-1Not reported
Susegoogle-cloud-sap-agentrpmlinux enterprise module for public cloud 123.15-6.78.1Not reportedSUSE-SU-2026:3883-1Not reported
Susehelmrpmlinux enterprise micro 5.53.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise module for containers 15 sp73.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise module for package hub 15 sp73.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp4-espos3.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp4-ltss3.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp5-espos3.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise high performance computing 15 sp5-ltss3.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise server 15 sp4-ltss3.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise server 15 sp5-ltss3.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise server 15 sp6-ltss3.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp43.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp53.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Susehelmrpmlinux enterprise server for sap applications 15 sp63.21.3-150000.1.93.1Not reportedSUSE-SU-2026:3882-1Not reported
Opensuseapptainerrpmleap 16.01.5.3-bp160.3.1Not reportedOPENSUSE-SU-2026:21787-1Not reported
Opensusemcphostrpmleap 16.00.34.0-160000.4.1Not reportedOPENSUSE-SU-2026:21771-1Not reported
Opensusegoogle-cloud-sap-agentrpmleap 16.03.15-160000.3.1Not reportedOPENSUSE-SU-2026:21755-1Not reported
Opensusehelmrpmtumbleweed4.2.4-1.1Not reportedOPENSUSE-SU-2026:11668-1Not reported
Opensuseapptainerrpmtumbleweed1.5.3-3.1Not reportedOPENSUSE-SU-2026:11664-1Not reported
Opensusemcphostrpmtumbleweed0.34.0-10.1Not reportedOPENSUSE-SU-2026:11670-1Not reported
Opensusecorednsrpmleap 16.01.14.7-bp160.1.1Not reportedOPENSUSE-SU-2026:21674-1Not reported
Opensusedistributionrpmtumbleweed3.1.1-5.1Not reportedOPENSUSE-SU-2026:11609-1Not reported
Opensusecorednsrpmtumbleweed1.14.7-1.1Not reportedOPENSUSE-SU-2026:11608-1Not reported
Opensusehelm3rpmtumbleweed3.21.3-6.1Not reportedOPENSUSE-SU-2026:11610-1Not reported
Opensuseazure-storage-azcopyrpmtumbleweed10.32.7-1.1Not reportedOPENSUSE-SU-2026:11604-1Not reported
Opensuseamazon-cloudwatch-agentrpmtumbleweed1.300071.0-2.1Not reportedOPENSUSE-SU-2026:11603-1Not reported
Opensusecadvisorrpmtumbleweed0.60.5-2.1Not reportedOPENSUSE-SU-2026:11606-1Not reported
Opensusebuildpacks-clirpmtumbleweed0.40.9-1.1Not reportedOPENSUSE-SU-2026:11493-1Not reported
Opensuseghrpmleap 16.02.102.0-bp160.1.1Not reportedOPENSUSE-SU-2026:22134-1Not reported
Opensuseghrpmtumbleweed2.102.0-1.1Not reportedOPENSUSE-SU-2026:12163-1Not reported

[Debian bug #1139167]

Notes

[trixie] golang-opentelemetry-otel: Minor issue [bookworm] golang-opentelemetry-otel: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • Source package: [golang-opentelemetry-otel]

    Details (2)
    • 1.1.0-2 · all · bookworm

      Affected

      nvd · golang-opentelemetry-otel · debian · bookworm; nvd · golang-opentelemetry-otel · debian · 12

    • 1.1.0-2 · all · bookworm

      Affected

      nvd · golang-opentelemetry-otel · debian · bookworm; nvd · golang-opentelemetry-otel · debian · 12

[Debian 13 (Trixie)]

[openSUSE Tumbleweed]

Next results

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Go Vulnerability Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]