CVE-2026-54285

Katalog CVE

CVSS 5.3 · Medium EPSS 0,40%

Kerentanan Allocation of Resources Without Limits or Throttling pada opentelemetry. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.

Rincian

Terbit di NVD

22 Juni 2026

Terakhir diubah

27 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf advisory vendor · mitigasi