opentelemetry_sdk

The SDK for the OpenTelemetry metrics collection and distributed tracing framework

View on Cargo

Activity

Latest release: 2w ago
Total releases: 24
Cadence: ~2 months
Last 12 months: 4

Reach

Downloads: 240.2M

Details

License: Apache-2.0
First release: Jun 27, 2019

Releases

Version	Released
`0.33.1` patch	Oct 09, 2026
`0.33.0` minor	Sep 18, 2026
`0.32.1` unknown	May 26, 2026
`0.32.0` unknown 1 CVE	May 08, 2026
`0.31.0` unknown 1 CVE	Sep 25, 2025
`0.30.0` unknown 1 CVE	May 23, 2025
`0.29.0` unknown 1 CVE	Mar 22, 2025
`0.28.0` unknown 1 CVE	Feb 10, 2025
`0.27.1` unknown 1 CVE	Nov 27, 2024
`0.27.0` unknown 1 CVE	Nov 12, 2024
`0.26.0` unknown 1 CVE	Oct 01, 2024
`0.25.0` unknown 1 CVE	Sep 09, 2024
`0.24.1` unknown 1 CVE	Jul 18, 2024
`0.24.0` unknown 1 CVE	Jul 15, 2024
`0.23.0` unknown 1 CVE	May 15, 2024
`0.22.1` unknown 1 CVE	Feb 26, 2024
`0.22.0` unknown 1 CVE	Feb 25, 2024
`0.21.2` unknown 1 CVE	Jan 04, 2024
`0.21.1` unknown 1 CVE	Nov 13, 2023
`0.21.0` unknown 1 CVE	Nov 06, 2023
`0.20.0` unknown 1 CVE	Jul 29, 2023
`0.19.0` unknown 1 CVE	Mar 26, 2023
`0.18.0` unknown 1 CVE	Sep 13, 2022
`0.1.0` unknown 1 CVE	Jun 27, 2019

Dependencies (22)

Depends on

0.33.1

Used by

1557

Supply-chain exposure

1,557 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (1)

CVE-2026-48504 GHSA-w9wp-h8wv-79jx Jun 25, 2026

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

5.3 / 10
Medium
Network Low None None Unchanged None None Low

Summary

BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce the W3C Baggage size limits before parsing an inbound baggage header. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits.

The SDK now applies limits aligned with the W3C Baggage limits:

64 list-members

8192 bytes total

Impact

Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits.

The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution.

Patches

Upgrade opentelemetry_sdk to version 0.32.1 or later.

Version 0.32.1 rejects baggage header values larger than 8192 bytes and limits extraction to the first 64 list-members.

Workarounds

If upgrading immediately is not possible, reject or limit inbound baggage headers larger than 8192 bytes before invoking OpenTelemetry propagation extraction. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.

Resources

W3C Baggage limits: https://www.w3.org/TR/baggage/#limits

Related OpenTelemetry Java advisory: https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx

Related OpenTelemetry Go advisory: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475

CVE-2026-48504

Credit

tonghuaroot

Fixed in

0.32.1

References

https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx
https://github.com/open-telemetry/opentelemetry-rust

Updated Sep 10, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 1
patch 1
unknown 22

24 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More