etcd-3.6.13-1.1 on GA media
CVE-2026-29181 is a denial of service vulnerability in OpenTelemetry-Go, the Go implementation of OpenTelemetry. An attacker can exploit this flaw by sending multiple crafted 'baggage' HTTP header lines, causing excessive CPU and memory consumption. This vulnerability affects the multicluster engine for Kubernetes and related components, potentially rendering services unavailable. The issue is addressed in the etcd-3.6.13-1.1 package on openSUSE Tumbleweed and is relevant to certain SUSE product versions. The vulnerability is rated medium severity.
AI Analysis
Technical Summary
CVE-2026-29181 is a resource exhaustion vulnerability in OpenTelemetry-Go caused by improper handling of multiple 'baggage' HTTP header lines. The system independently parses and aggregates each header field-value, leading to amplified CPU and memory allocations. This can be exploited remotely without authentication to cause a denial of service by exhausting system resources. The vulnerability affects Red Hat Multicluster Engine for Kubernetes and related products. The CWE classification is CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
A remote attacker can cause a denial of service by sending multiple crafted 'baggage' HTTP header lines, resulting in excessive CPU and memory consumption. This can disrupt availability of affected services, particularly in multi-cluster Kubernetes environments. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in the etcd-3.6.13-1.1 package on openSUSE Tumbleweed and related SUSE products. Users should apply this update to remediate the vulnerability. The vendor advisory from Red Hat confirms the availability of fixes in updated product versions. No additional mitigations are specified or required beyond applying the official patches.
etcd-3.6.13-1.1 on GA media
Description
CVE-2026-29181 is a denial of service vulnerability in OpenTelemetry-Go, the Go implementation of OpenTelemetry. An attacker can exploit this flaw by sending multiple crafted 'baggage' HTTP header lines, causing excessive CPU and memory consumption. This vulnerability affects the multicluster engine for Kubernetes and related components, potentially rendering services unavailable. The issue is addressed in the etcd-3.6.13-1.1 package on openSUSE Tumbleweed and is relevant to certain SUSE product versions. The vulnerability is rated medium severity.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-29181 is a resource exhaustion vulnerability in OpenTelemetry-Go caused by improper handling of multiple 'baggage' HTTP header lines. The system independently parses and aggregates each header field-value, leading to amplified CPU and memory allocations. This can be exploited remotely without authentication to cause a denial of service by exhausting system resources. The vulnerability affects Red Hat Multicluster Engine for Kubernetes and related products. The CWE classification is CWE-770 (Allocation of Resources Without Limits or Throttling).
Potential Impact
A remote attacker can cause a denial of service by sending multiple crafted 'baggage' HTTP header lines, resulting in excessive CPU and memory consumption. This can disrupt availability of affected services, particularly in multi-cluster Kubernetes environments. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported.
Mitigation Recommendations
A fix is available in the etcd-3.6.13-1.1 package on openSUSE Tumbleweed and related SUSE products. Users should apply this update to remediate the vulnerability. The vendor advisory from Red Hat confirms the availability of fixes in updated product versions. No additional mitigations are specified or required beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- CLEANSTART-2026-UN60914
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Alpine"]
- State
- PUBLISHED
Threat ID: 6a7f442ebf8831d5396347bf
Added to database: 08/14/2026, 16:37:02 UTC
Last enriched: 09/17/2026, 03:37:33 UTC
Last updated: 09/28/2026, 13:47:43 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.