opentelemetry-propagator-jaeger
OpenTelemetry Python API and SDK
View on Github
Activity
- Latest release
- 1d ago
- Total releases
- 67
- Cadence
- ~34 days
- Last 12 months
- 12
Reach
- Stars
- 2.7k
Details
- License
- Apache-2.0
- First release
- Jan 20, 2021
| Version | Released | |
|---|---|---|
1.45.2
patch
| ||
1.45.1
patch
| ||
1.45.0
minor
| ||
1.44.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.43.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.42.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.42.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.41.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.41.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.40.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.39.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.39.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.38.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.37.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.36.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.35.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.34.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.34.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.33.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.33.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.32.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.32.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.31.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.31.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.30.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.29.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.28.2
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.28.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.28.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.27.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.26.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.25.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.24.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.23.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.22.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.21.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.20.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.19.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.18.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.17.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.16.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.15.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.14.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.13.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.12.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.12.0rc2
pre
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.12.0rc1
pre
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.11.1
patch
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.11.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev | ||
1.10.0
minor
1 CVE
CVE-2026-116694
GHSA-f5m9-jfrj-jjj7
Oct 27, 2026
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
Medium
Network
Low
None
None
Summary
ImpactServices that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits. The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration. Common Python web servers also constrain request headers before they reach the propagator:
The risk is higher for non-HTTP transports, custom The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution. PatchesVersions of Upgrade Version Credittonghuaroot Affected versions
0.17b0
1.0.0
1.0.0rc1
1.1.0
1.10.0
1.11.0
1.11.1
1.12.0
1.12.0rc1
1.12.0rc2
1.13.0
1.14.0
+ 52 more Show less
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.2.0
1.20.0
1.21.0
1.22.0
1.23.0
1.24.0
1.25.0
1.26.0
1.27.0
1.28.0
1.28.1
1.28.2
1.29.0
1.3.0
1.30.0
1.31.0
1.31.1
1.32.0
1.32.1
1.33.0
1.33.1
1.34.0
1.34.1
1.35.0
1.36.0
1.37.0
1.38.0
1.39.0
1.39.1
1.4.0
1.4.1
1.40.0
1.41.0
1.41.1
1.42.0
1.42.1
1.43.0
1.44.0
1.5.0
1.6.0
1.6.1
1.6.2
1.7.0
1.7.1
1.8.0
1.9.0
1.9.1
Fixed in
1.45.0
References
Updated Oct 27, 2026 · Source: OSV.dev |