OpenTelemetry-Go versions from 1.0.0-RC1 up to but not including 1.47.0 contain a vulnerability in the baggage metadata parsing implementation. The library eagerly materializes W3C baggage properties during parsing, causing bounded but disproportionate memory allocation amplification when processing densely populated headers. This can lead to increased memory allocation and garbage collection pressure, especially on services that enable baggage propagation and extract attacker-controlled context before authentication. The issue does not reliably cause out-of-memory conditions or complete denial of service. The vulnerability is fixed in version 1.47.0 by introducing lazy materialization of properties and in-place validation and normalization.