The vulnerability in opentelemetry-go from versions 1.36.0 to 1.40.0 arises from the way multi-value baggage headers are parsed. Each header field-value is processed independently, and members are aggregated across these values without limits or throttling. This can be exploited by an attacker to amplify CPU consumption and resource allocations by sending numerous baggage header lines, leading to potential denial-of-service conditions. The issue is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The fix is included in version 1.41.0 of the library.

An attacker can exploit this vulnerability to cause high CPU usage and increased memory allocations on systems using affected versions of opentelemetry-go. This can degrade service performance or cause denial-of-service conditions. There is no impact on confidentiality or integrity reported. No known exploits are currently in the wild.

Upgrade opentelemetry-go to version 1.41.0 or later, where this vulnerability is fixed. Since no official patch links or vendor advisories are provided, verify the upgrade through the official open-telemetry project releases. Patch status is confirmed by the description stating the issue is fixed in 1.41.0. No other mitigations are indicated.