CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-54285

opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 27.0%

CVSS Severity

CVSS v3 Score 5.3

References

https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf

Products affected by CVE-2026-54285

Opentelemetry » Opentelemetry » Version: 0.1.0

cpe:2.3:a:opentelemetry:opentelemetry:0.1.0
Opentelemetry » Opentelemetry » Version: 0.1.1

cpe:2.3:a:opentelemetry:opentelemetry:0.1.1
Opentelemetry » Opentelemetry » Version: 0.10.0

cpe:2.3:a:opentelemetry:opentelemetry:0.10.0
Opentelemetry » Opentelemetry » Version: 0.10.1

cpe:2.3:a:opentelemetry:opentelemetry:0.10.1
Opentelemetry » Opentelemetry » Version: 0.10.2

cpe:2.3:a:opentelemetry:opentelemetry:0.10.2
Opentelemetry » Opentelemetry » Version: 0.10.3

cpe:2.3:a:opentelemetry:opentelemetry:0.10.3
Opentelemetry » Opentelemetry » Version: 0.11.0

cpe:2.3:a:opentelemetry:opentelemetry:0.11.0
Opentelemetry » Opentelemetry » Version: 0.12.0

cpe:2.3:a:opentelemetry:opentelemetry:0.12.0
Opentelemetry » Opentelemetry » Version: 0.13.0

cpe:2.3:a:opentelemetry:opentelemetry:0.13.0
Opentelemetry » Opentelemetry » Version: 0.14.0

cpe:2.3:a:opentelemetry:opentelemetry:0.14.0
Opentelemetry » Opentelemetry » Version: 0.15.0

cpe:2.3:a:opentelemetry:opentelemetry:0.15.0
Opentelemetry » Opentelemetry » Version: 0.16.0

cpe:2.3:a:opentelemetry:opentelemetry:0.16.0
Opentelemetry » Opentelemetry » Version: 0.17.0

cpe:2.3:a:opentelemetry:opentelemetry:0.17.0
Opentelemetry » Opentelemetry » Version: 0.18.0

cpe:2.3:a:opentelemetry:opentelemetry:0.18.0
Opentelemetry » Opentelemetry » Version: 0.18.1

cpe:2.3:a:opentelemetry:opentelemetry:0.18.1
Opentelemetry » Opentelemetry » Version: 0.18.2

cpe:2.3:a:opentelemetry:opentelemetry:0.18.2
Opentelemetry » Opentelemetry » Version: 0.19.0

cpe:2.3:a:opentelemetry:opentelemetry:0.19.0
Opentelemetry » Opentelemetry » Version: 0.2.0

cpe:2.3:a:opentelemetry:opentelemetry:0.2.0
Opentelemetry » Opentelemetry » Version: 0.20.0

cpe:2.3:a:opentelemetry:opentelemetry:0.20.0
Opentelemetry » Opentelemetry » Version: 0.21.0

cpe:2.3:a:opentelemetry:opentelemetry:0.21.0
Opentelemetry » Opentelemetry » Version: 0.22.0

cpe:2.3:a:opentelemetry:opentelemetry:0.22.0
Opentelemetry » Opentelemetry » Version: 0.23.0

cpe:2.3:a:opentelemetry:opentelemetry:0.23.0
Opentelemetry » Opentelemetry » Version: 0.24.0

cpe:2.3:a:opentelemetry:opentelemetry:0.24.0
Opentelemetry » Opentelemetry » Version: 0.25.0

cpe:2.3:a:opentelemetry:opentelemetry:0.25.0
Opentelemetry » Opentelemetry » Version: 0.26.0

cpe:2.3:a:opentelemetry:opentelemetry:0.26.0
Opentelemetry » Opentelemetry » Version: 0.28.0

cpe:2.3:a:opentelemetry:opentelemetry:0.28.0
Opentelemetry » Opentelemetry » Version: 0.3.0

cpe:2.3:a:opentelemetry:opentelemetry:0.3.0
Opentelemetry » Opentelemetry » Version: 0.3.1

cpe:2.3:a:opentelemetry:opentelemetry:0.3.1
Opentelemetry » Opentelemetry » Version: 0.3.2

cpe:2.3:a:opentelemetry:opentelemetry:0.3.2
Opentelemetry » Opentelemetry » Version: 0.3.3

cpe:2.3:a:opentelemetry:opentelemetry:0.3.3
Opentelemetry » Opentelemetry » Version: 0.4.0

cpe:2.3:a:opentelemetry:opentelemetry:0.4.0
Opentelemetry » Opentelemetry » Version: 0.5.0

cpe:2.3:a:opentelemetry:opentelemetry:0.5.0
Opentelemetry » Opentelemetry » Version: 0.5.1

cpe:2.3:a:opentelemetry:opentelemetry:0.5.1
Opentelemetry » Opentelemetry » Version: 0.5.2

cpe:2.3:a:opentelemetry:opentelemetry:0.5.2
Opentelemetry » Opentelemetry » Version: 0.6.0

cpe:2.3:a:opentelemetry:opentelemetry:0.6.0
Opentelemetry » Opentelemetry » Version: 0.6.1

cpe:2.3:a:opentelemetry:opentelemetry:0.6.1
Opentelemetry » Opentelemetry » Version: 0.7.0

cpe:2.3:a:opentelemetry:opentelemetry:0.7.0
Opentelemetry » Opentelemetry » Version: 0.8.0

cpe:2.3:a:opentelemetry:opentelemetry:0.8.0
Opentelemetry » Opentelemetry » Version: 0.8.1

cpe:2.3:a:opentelemetry:opentelemetry:0.8.1
Opentelemetry » Opentelemetry » Version: 0.8.2

cpe:2.3:a:opentelemetry:opentelemetry:0.8.2
Opentelemetry » Opentelemetry » Version: 0.8.3

cpe:2.3:a:opentelemetry:opentelemetry:0.8.3
Opentelemetry » Opentelemetry » Version: 0.9.0

cpe:2.3:a:opentelemetry:opentelemetry:0.9.0
Opentelemetry » Opentelemetry » Version: 1.0.0

cpe:2.3:a:opentelemetry:opentelemetry:1.0.0
Opentelemetry » Opentelemetry » Version: 1.0.1

cpe:2.3:a:opentelemetry:opentelemetry:1.0.1
Opentelemetry » Opentelemetry » Version: 1.0.2

cpe:2.3:a:opentelemetry:opentelemetry:1.0.2
Opentelemetry » Opentelemetry » Version: 1.0.3

cpe:2.3:a:opentelemetry:opentelemetry:1.0.3
Opentelemetry » Opentelemetry » Version: 1.0.4

cpe:2.3:a:opentelemetry:opentelemetry:1.0.4
Opentelemetry » Opentelemetry » Version: 1.1.0

cpe:2.3:a:opentelemetry:opentelemetry:1.1.0
Opentelemetry » Opentelemetry » Version: 1.1.1

cpe:2.3:a:opentelemetry:opentelemetry:1.1.1
Opentelemetry » Opentelemetry » Version: 1.10.0

cpe:2.3:a:opentelemetry:opentelemetry:1.10.0
Opentelemetry » Opentelemetry » Version: 1.10.1

cpe:2.3:a:opentelemetry:opentelemetry:1.10.1
Opentelemetry » Opentelemetry » Version: 1.11.0

cpe:2.3:a:opentelemetry:opentelemetry:1.11.0
Opentelemetry » Opentelemetry » Version: 1.12.0

cpe:2.3:a:opentelemetry:opentelemetry:1.12.0
Opentelemetry » Opentelemetry » Version: 1.13.0

cpe:2.3:a:opentelemetry:opentelemetry:1.13.0
Opentelemetry » Opentelemetry » Version: 1.14.0

cpe:2.3:a:opentelemetry:opentelemetry:1.14.0
Opentelemetry » Opentelemetry » Version: 1.15.0

cpe:2.3:a:opentelemetry:opentelemetry:1.15.0
Opentelemetry » Opentelemetry » Version: 1.15.1

cpe:2.3:a:opentelemetry:opentelemetry:1.15.1
Opentelemetry » Opentelemetry » Version: 1.15.2

cpe:2.3:a:opentelemetry:opentelemetry:1.15.2
Opentelemetry » Opentelemetry » Version: 1.16.0

cpe:2.3:a:opentelemetry:opentelemetry:1.16.0
Opentelemetry » Opentelemetry » Version: 1.17.0

cpe:2.3:a:opentelemetry:opentelemetry:1.17.0
Opentelemetry » Opentelemetry » Version: 1.17.1

cpe:2.3:a:opentelemetry:opentelemetry:1.17.1
Opentelemetry » Opentelemetry » Version: 1.18.0

cpe:2.3:a:opentelemetry:opentelemetry:1.18.0
Opentelemetry » Opentelemetry » Version: 1.18.1

cpe:2.3:a:opentelemetry:opentelemetry:1.18.1
Opentelemetry » Opentelemetry » Version: 1.19.0

cpe:2.3:a:opentelemetry:opentelemetry:1.19.0
Opentelemetry » Opentelemetry » Version: 1.2.0

cpe:2.3:a:opentelemetry:opentelemetry:1.2.0
Opentelemetry » Opentelemetry » Version: 1.20.0

cpe:2.3:a:opentelemetry:opentelemetry:1.20.0
Opentelemetry » Opentelemetry » Version: 1.21.0

cpe:2.3:a:opentelemetry:opentelemetry:1.21.0
Opentelemetry » Opentelemetry » Version: 1.22.0

cpe:2.3:a:opentelemetry:opentelemetry:1.22.0
Opentelemetry » Opentelemetry » Version: 1.23.0

cpe:2.3:a:opentelemetry:opentelemetry:1.23.0
Opentelemetry » Opentelemetry » Version: 1.24.0

cpe:2.3:a:opentelemetry:opentelemetry:1.24.0
Opentelemetry » Opentelemetry » Version: 1.24.1

cpe:2.3:a:opentelemetry:opentelemetry:1.24.1
Opentelemetry » Opentelemetry » Version: 1.25.0

cpe:2.3:a:opentelemetry:opentelemetry:1.25.0
Opentelemetry » Opentelemetry » Version: 1.25.1

cpe:2.3:a:opentelemetry:opentelemetry:1.25.1
Opentelemetry » Opentelemetry » Version: 1.26.0

cpe:2.3:a:opentelemetry:opentelemetry:1.26.0
Opentelemetry » Opentelemetry » Version: 1.27.0

cpe:2.3:a:opentelemetry:opentelemetry:1.27.0
Opentelemetry » Opentelemetry » Version: 1.28.0

cpe:2.3:a:opentelemetry:opentelemetry:1.28.0
Opentelemetry » Opentelemetry » Version: 1.29.0

cpe:2.3:a:opentelemetry:opentelemetry:1.29.0
Opentelemetry » Opentelemetry » Version: 1.3.0

cpe:2.3:a:opentelemetry:opentelemetry:1.3.0
Opentelemetry » Opentelemetry » Version: 1.30.0

cpe:2.3:a:opentelemetry:opentelemetry:1.30.0
Opentelemetry » Opentelemetry » Version: 1.30.1

cpe:2.3:a:opentelemetry:opentelemetry:1.30.1
Opentelemetry » Opentelemetry » Version: 1.4.0

cpe:2.3:a:opentelemetry:opentelemetry:1.4.0
Opentelemetry » Opentelemetry » Version: 1.5.0

cpe:2.3:a:opentelemetry:opentelemetry:1.5.0
Opentelemetry » Opentelemetry » Version: 1.6.0

cpe:2.3:a:opentelemetry:opentelemetry:1.6.0
Opentelemetry » Opentelemetry » Version: 1.7.0

cpe:2.3:a:opentelemetry:opentelemetry:1.7.0
Opentelemetry » Opentelemetry » Version: 1.8.0

cpe:2.3:a:opentelemetry:opentelemetry:1.8.0
Opentelemetry » Opentelemetry » Version: 1.9.0

cpe:2.3:a:opentelemetry:opentelemetry:1.9.0
Opentelemetry » Opentelemetry » Version: 1.9.1

cpe:2.3:a:opentelemetry:opentelemetry:1.9.1
Opentelemetry » Opentelemetry » Version: 2.0.0

cpe:2.3:a:opentelemetry:opentelemetry:2.0.0
Opentelemetry » Opentelemetry » Version: 2.0.1

cpe:2.3:a:opentelemetry:opentelemetry:2.0.1
Opentelemetry » Opentelemetry » Version: 2.1.0

cpe:2.3:a:opentelemetry:opentelemetry:2.1.0
Opentelemetry » Opentelemetry » Version: 2.2.0

cpe:2.3:a:opentelemetry:opentelemetry:2.2.0
Opentelemetry » Opentelemetry » Version: 2.3.0

cpe:2.3:a:opentelemetry:opentelemetry:2.3.0
Opentelemetry » Opentelemetry » Version: 2.4.0

cpe:2.3:a:opentelemetry:opentelemetry:2.4.0
Opentelemetry » Opentelemetry » Version: 2.5.0

cpe:2.3:a:opentelemetry:opentelemetry:2.5.0
Opentelemetry » Opentelemetry » Version: 2.5.1

cpe:2.3:a:opentelemetry:opentelemetry:2.5.1
Opentelemetry » Opentelemetry » Version: 2.6.0

cpe:2.3:a:opentelemetry:opentelemetry:2.6.0
Opentelemetry » Opentelemetry » Version: 2.6.1

cpe:2.3:a:opentelemetry:opentelemetry:2.6.1
Opentelemetry » Opentelemetry » Version: 2.7.0

cpe:2.3:a:opentelemetry:opentelemetry:2.7.0
Opentelemetry » Opentelemetry » Version: 2.7.1

cpe:2.3:a:opentelemetry:opentelemetry:2.7.1

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-54285

Products

Pricing

Contact Us