CVE-2026-54285

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-54285
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54285.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-54285
Aliases
Downstream
Related
Published
2026-06-22T16:52:54.233Z
Modified
2026-08-29T11:47:07.698457658Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation
Details

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54285.json",
    "cwe_ids": [
        "CWE-770"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/open-telemetry/opentelemetry-js

Affected ranges

Type
GIT
Repo
https://github.com/open-telemetry/opentelemetry-js
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
13a035bc695996cf4aec885fef7b9866f48bc555
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:node.js:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.8.0"
        }
    ]
}

Affected versions

0.*
0.11.0
api/v1.*
api/v1.3.0
api/v1.4.0
api/v1.4.1
api/v1.5.0
api/v1.6.0
api/v1.7.0
api/v1.8.0
api/v1.9.0
api/v1.9.1
experimental/v0.*
experimental/v0.200.0
experimental/v0.201.0
experimental/v0.201.1
experimental/v0.202.0
experimental/v0.203.0
experimental/v0.204.0
experimental/v0.205.0
experimental/v0.206.0
experimental/v0.207.0
experimental/v0.208.0
experimental/v0.209.0
experimental/v0.210.0
experimental/v0.211.0
experimental/v0.212.0
experimental/v0.213.0
experimental/v0.214.0
experimental/v0.215.0
experimental/v0.216.0
experimental/v0.217.0
experimental/v0.218.0
experimental/v0.27.0
experimental/v0.29.0
experimental/v0.29.1
experimental/v0.30.0
experimental/v0.31.0
experimental/v0.32.0
experimental/v0.33.0
experimental/v0.34.0
experimental/v0.35.0
experimental/v0.35.1
experimental/v0.36.0
experimental/v0.37.0
experimental/v0.38.0
experimental/v0.39.0
experimental/v0.39.1
experimental/v0.40.0
experimental/v0.41.0
experimental/v0.41.1
experimental/v0.41.2
experimental/v0.42.0
experimental/v0.43.0
experimental/v0.44.0
experimental/v0.45.0
experimental/v0.45.1
experimental/v0.46.0
experimental/v0.47.0
experimental/v0.48.0
experimental/v0.49.0
experimental/v0.49.1
experimental/v0.50.0
experimental/v0.51.0
experimental/v0.52.0
experimental/v0.52.1
experimental/v0.53.0
experimental/v0.54.0
experimental/v0.54.1
experimental/v0.54.2
experimental/v0.55.0
experimental/v0.56.0
experimental/v0.57.0
semconv/v1.*
semconv/v1.26.0
semconv/v1.27.0
semconv/v1.28.0
semconv/v1.29.0
semconv/v1.30.0
semconv/v1.31.0
semconv/v1.32.0
semconv/v1.33.0
semconv/v1.33.1
semconv/v1.34.0
semconv/v1.36.0
semconv/v1.37.0
semconv/v1.38.0
semconv/v1.39.0
semconv/v1.40.0
semconv/v1.41.1
stable/v1.*
stable/v1.0.0
stable/v1.0.1
v0.*
v0.1.0
v0.1.1
v0.10.0
v0.10.1
v0.10.2
v0.10.3-canary.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.18.1
v0.18.2
v0.19.0
v0.2.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.28.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.6.0
v0.6.1
v0.7.0
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v1.*
v1.1.0
v1.1.1
v1.10.0
v1.11.0
v1.12.0
v1.13.0
v1.14.0
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.17.0
v1.17.1
v1.18.0
v1.18.1
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.22.0
v1.23.0
v1.24.0
v1.25.0
v1.25.1
v1.26.0
v1.27.0
v1.28.0
v1.29.0
v1.3.0
v1.30.0
v1.4.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.1
v2.*
v2.0.0
v2.0.1
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v2.7.0
v2.7.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54285.json"