What is CVE-2026-116694?

CVE-2026-116694 is a medium-severity allocation of resources without limits or throttling vulnerability in opentelemetry-propagator-jaeger (pip), affecting versions <= 1.44.0. It is fixed in 1.45.0. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.

Which versions of opentelemetry-propagator-jaeger are affected by CVE-2026-116694?

opentelemetry-propagator-jaeger (pip) versions <= 1.44.0 is affected.

Is there a fix for CVE-2026-116694?

Yes. CVE-2026-116694 is fixed in 1.45.0. Upgrade to this version or later.

Is CVE-2026-116694 exploitable, and should I be worried?

Whether CVE-2026-116694 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

What actually determines whether CVE-2026-116694 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

How do I fix CVE-2026-116694?

Upgrade opentelemetry-propagator-jaeger to 1.45.0 or later.

CVE-2026-116694 in opentelemetry-propagator-jaeger

Q: Which versions of opentelemetry-propagator-jaeger are affected by CVE-2026-116694?

opentelemetry-propagator-jaeger (pip) versions <= 1.44.0 is affected.

Q: Is there a fix for CVE-2026-116694?

Yes. CVE-2026-116694 is fixed in 1.45.0. Upgrade to this version or later.

Q: Is CVE-2026-116694 exploitable, and should I be worried?

Whether CVE-2026-116694 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk.

Q: What actually determines whether CVE-2026-116694 is exploitable, and how bad it is?

Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.

Q: How do I fix CVE-2026-116694?

Upgrade opentelemetry-propagator-jaeger to 1.45.0 or later.

Summary

OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

JaegerPropagator.extract() in opentelemetry-propagator-jaeger did not enforce limits when extracting inbound uberctx-* baggage headers. Attacker-controlled baggage could cause unnecessary CPU work and short-lived heap allocations while processing more data than the propagator should accept.

Credit

tonghuaroot

Impact

Services that enable the optional Jaeger propagator and accept untrusted inbound propagation headers may experience increased per-request resource usage. This can contribute to denial-of-service risk when transport-level limits are absent or configured above the baggage limits.

The practical impact for most Python web deployments is limited. The package must be installed separately, and the Jaeger propagator is not enabled by the default OpenTelemetry Python configuration.

Common Python web servers also constrain request headers before they reach the propagator:

Gunicorn allows a maximum of 100 request-header fields and 8,190 bytes per field by default.
Uvicorn’s h11 implementation limits its incomplete-event buffer to 16,384 bytes by default.

The risk is higher for non-HTTP transports, custom TextMapGetter implementations, or deployments where server and gateway limits have been increased or disabled.

The impact is limited to availability. This issue does not expose or modify telemetry data and does not allow code execution.

The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap. Typical impact: resource exhaustion leading to denial of service.

Affected versions

opentelemetry-propagator-jaeger (<= 1.44.0)

Security releases

opentelemetry-propagator-jaeger → 1.45.0 (pip)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environment New to Kodem? Get a demo →

Remediation advice

Versions of opentelemetry-propagator-jaeger earlier than 1.45.0 are affected.

Upgrade opentelemetry-propagator-jaeger to version 1.45.0 or later.

Version 1.45.0 limits extraction to 180 entries and 8,192 total bytes and skips entries larger than 4,096 bytes.

Frequently Asked Questions

What is CVE-2026-116694? CVE-2026-116694 is a medium-severity allocation of resources without limits or throttling vulnerability in opentelemetry-propagator-jaeger (pip), affecting versions <= 1.44.0. It is fixed in 1.45.0. The application allocates resources such as memory, threads, or file descriptors based on untrusted input without enforcing a cap.
Which versions of opentelemetry-propagator-jaeger are affected by CVE-2026-116694? opentelemetry-propagator-jaeger (pip) versions <= 1.44.0 is affected.
Is there a fix for CVE-2026-116694? Yes. CVE-2026-116694 is fixed in 1.45.0. Upgrade to this version or later.
Is CVE-2026-116694 exploitable, and should I be worried? Whether CVE-2026-116694 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
What actually determines whether CVE-2026-116694 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
How do I fix CVE-2026-116694? Upgrade opentelemetry-propagator-jaeger to 1.45.0 or later.