In opentelemetry-rust versions 0.32.0 and earlier, the BaggagePropagator::extract_with_context function in the opentelemetry_sdk did not enforce W3C Baggage size limits prior to parsing inbound baggage headers. As a result, an attacker could send oversized baggage headers that cause unnecessary CPU work and heap allocations during parsing, even though entries exceeding storage limits are later discarded. This resource exhaustion vulnerability could increase per-request resource usage in services accepting untrusted inbound propagation headers. The vulnerability is addressed in version 0.32.1.

This vulnerability allows an attacker to cause increased CPU and memory usage on affected services by sending large, attacker-controlled baggage headers. While it does not lead to data compromise or denial of service directly, the increased resource consumption could degrade service performance or availability under high load.

Upgrade opentelemetry-rust to version 0.32.1 or later, where this issue is fixed. No other mitigations are specified. Patch status is confirmed by the vendor advisory indicating the fix in 0.32.1.