The vulnerability identified as CVE-2026-41178 affects the OpenTelemetry-Go implementation, specifically the baggage package. In versions 1.41.0 and 1.43.0, the removal of raw-length rejection allowed the Parse function to accept and process excessively large or invalid baggage headers. This can cause memory allocation with excessive size values, leading to denial of service conditions due to resource exhaustion. The issue is addressed in versions 1.42.0 and 1.44.0, which restore proper validation and mitigate the risk. The CVSS 3.1 score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability enables denial of service attacks by allowing an attacker to send oversized baggage headers that cause excessive memory allocation in the affected OpenTelemetry-Go versions. This impacts the availability of services using these specific versions (1.41.0 and 1.43.0) but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.

Versions 1.42.0 and 1.44.0 of OpenTelemetry-Go have fixed this vulnerability by restoring raw-length rejection and proper validation of baggage headers. Users should upgrade to these or later versions to mitigate the risk. Patch status is not explicitly confirmed in the provided data; therefore, users should consult the official OpenTelemetry project advisories or repositories for the latest remediation information. No additional mitigation steps are indicated by the vendor advisory.