OpenTelemetry-Go, the Go implementation of OpenTelemetry, improperly handles multi-value baggage HTTP headers from versions 1.36.0 to 1.40.0. Each header field-value is parsed independently and aggregated without limits, enabling an attacker to amplify CPU and memory allocations by sending numerous baggage header lines, even if each individual value respects the 8192-byte per-value limit. This results in resource exhaustion and a denial of service condition. The issue is tracked as CWE-770 (Allocation of Resources Without Limits or Throttling) and is fixed in version 1.41.0. Red Hat advisories confirm the vulnerability affects their Multicluster Engine for Kubernetes product and highlight the significant impact due to potential widespread disruption in multi-cluster environments.

The vulnerability allows remote attackers to cause a denial of service by exhausting CPU and memory resources through crafted multi-value baggage HTTP headers. This can render affected services unavailable, particularly impacting environments like Red Hat Multicluster Engine for Kubernetes that rely on OpenTelemetry-Go. There is no impact on confidentiality or integrity, but availability is highly affected.

A fix is available in OpenTelemetry-Go version 1.41.0. Users should upgrade to this version or later to remediate the vulnerability. Red Hat customers should follow the vendor advisories and upgrade affected products accordingly. No alternative mitigations or temporary fixes are documented in the advisory.