CVE-2026-45292: Io.opentelemetry Opentelemetry-API
Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days.
opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.
Affected products
- Io.opentelemetry Opentelemetry-API: version 1.62.0 only
- Io.opentelemetry Opentelemetry-Extension-Trace-Propagators: version 1.62.0 only
- Open-Telemetry Opentelemetry-Java: before 1.62.0 (fixed in 1.62.0)
- Red Hat Exploit Intelligence
- Red Hat Migration Toolkit For Containers
- Red Hat Openshift Lightspeed
- Red Hat Openshift Serverless
- Red Hat Red Hat 3scale API Management Platform 2
- Red Hat Red Hat Ai Inference Server
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Data Grid 8.6.2
- Red Hat Red Hat Enterprise Linux Ai Rhel Ai 3
- Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Red Hat Migration Toolkit For Applications 8.2: before 1784109883 (fixed in 1784109883)
- Red Hat Red Hat Offline Knowledge Portal 1.2.12: before 1782239370 (fixed in 1782239370)
- Red Hat Red Hat Openshift Ai 3.4: before 1787105144 (fixed in 1787105144); before 1787105133 (fixed in 1787105133); before 1787105315 (fixed in 1787105315); before 1787073479 (fixed in 1787073479)
- Red Hat Red Hat Openshift Ai Rhoai
- Red Hat Red Hat Openshift Dev Spaces 3.29: before 1783007534 (fixed in 1783007534); before 1782989367 (fixed in 1782989367)
- Red Hat Red Hat Quay 3
- Red Hat Red Hat Satellite 6
Published 2026-05-28. Last modified 2026-09-10.