CVE-2026-116694: Unbounded Memory Allocation and Denial of Service in OpenTelemetry Python Jaeger Propagator

Vulnerability ID: CVE-2026-116694

CVSS Score: 6.3

Published: 2026-10-27

CVE-2026-116694 (GHSA-f5m9-jfrj-jjj7) is an unbounded resource allocation vulnerability (CWE-770) in the optional Jaeger propagator component (opentelemetry-propagator-jaeger) of the OpenTelemetry Python SDK prior to version 1.45.0. When extracting distributed tracing context from inbound carriers, JaegerPropagator.extract() processes all headers prefixed with 'uberctx-' without enforcing limits on entry count, per-entry byte size, or aggregate byte size.…