CVE-2026-29181
Estado: ModificadaAlta (7.5)—
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.87%
- Percentil entre todas las CVEs puntuadas: 58
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1190Exploit Public-Facing Applicationinitial access85 % - Impacto principal
T1499.004Application or System Exploitationimpact90 %
Vector CVSS AV:N/AC:L/PR:N/UI:N indica explotación remota sin privilegios (T1190). CWE-770 y descripción confirman DoS por agotamiento de recursos (CPU y memoria) mediante headers HTTP malformados (T1499.004).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-770
- CWE-770
Referencias
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
- https://access.redhat.com/errata/RHSA-2026:25271
- https://access.redhat.com/errata/RHSA-2026:47735
- https://access.redhat.com/errata/RHSA-2026:61314
- https://access.redhat.com/errata/RHSA-2026:63140
- https://access.redhat.com/errata/RHSA-2026:66521
- https://access.redhat.com/security/cve/CVE-2026-29181
- https://bugzilla.redhat.com/show_bug.cgi?id=2456252
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-29181",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-29181",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-04-08T15:36:53.783712Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "open-telemetry",
"product": "opentelemetry-go",
"versions": [
{
"status": "affected",
"version": ">= 1.36.0, < 1.41.0"
}
]
}
]
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"affectedData": [
{
"cpes": [
"cpe:/a:redhat:cert_manager:1.19::el9"
],
"vendor": "Red Hat",
"product": "Cert Manager support for Red Hat OpenShift release 1.19",
"versions": [
{
"status": "unaffected",
"version": "1788348594",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "cert-manager/cert-manager-istio-csr-rhel9",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:cluster_observability_operator:1.5::el9"
],
"vendor": "Red Hat",
"product": "Cluster Observability Operator 1.5.0",
"versions": [
{
"status": "unaffected",
"version": "1787593637",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "cluster-observability-operator/cluster-observability-rhel9-operator",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:logging:6.6::el9"
],
"vendor": "Red Hat",
"product": "Logging Subsystem for Red Hat OpenShift 6.6",
"versions": [
{
"status": "unaffected",
"version": "1788439505",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "openshift-logging/cluster-logging-rhel9-operator",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.11::el9"
],
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.11",
"versions": [
{
"status": "unaffected",
"version": "1780917881",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine:2.8::el9"
],
"vendor": "Red Hat",
"product": "multicluster engine for Kubernetes 2.8",
"versions": [
{
"status": "unaffected",
"version": "1784738758",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "multicluster-engine/hypershift-addon-rhel9-operator",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:cert_manager:1"
],
"vendor": "Red Hat",
"product": "cert-manager Operator for Red Hat OpenShift",
"packageName": "cert-manager/jetstack-cert-manager-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/assisted-installer-agent-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/assisted-service-9-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/hypershift-rhel9-operator",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/managedcluster-import-controller-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/mce-capi-webhook-config-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/multicloud-manager-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/placement-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/registration-operator-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/registration-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"vendor": "Red Hat",
"product": "Multicluster Engine for Kubernetes",
"packageName": "multicluster-engine/work-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:acm:2"
],
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"packageName": "rhacm2/acm-must-gather-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unaffected"
},
{
"cpes": [
"cpe:/a:redhat:acm:2"
],
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"packageName": "rhacm2/multicluster-observability-rhel9-operator",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/a:redhat:acm:2"
],
"vendor": "Red Hat",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"packageName": "rhacm2/volsync-rhel9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
]
}
],
"published": "2026-04-07T21:17:16.003",
"references": [
{
"url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475",
"tags": [
"Exploit",
"Vendor Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:25271",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:47735",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:61314",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:63140",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:66521",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-29181",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456252",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
},
{
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-29181.json",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
},
{
"type": "Secondary",
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit. This vulnerability is fixed in 1.41.0."
},
{
"lang": "es",
"value": "OpenTelemetry-Go es la implementación en Go de OpenTelemetry. Desde la versión 1.36.0 hasta la 1.40.0, la extracción de encabezados 'baggage' con múltiples valores analiza cada par campo-valor del encabezado de forma independiente y agrega los miembros a través de los valores. Esto permite a un atacante amplificar el uso de CPU y las asignaciones de memoria enviando muchas líneas de encabezado 'baggage', incluso cuando cada valor individual está dentro del límite de análisis de 8192 bytes por valor. Esta vulnerabilidad está corregida en la versión 1.41.0."
}
],
"lastModified": "2026-09-11T13:17:25.487",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*",
"vulnerable": true,
"matchCriteriaId": "A92EDFF5-4806-4B87-86F2-A3BE4A0A02A9",
"versionEndExcluding": "1.41.0",
"versionStartIncluding": "1.36.0"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}