chore(deps): update module go.opentelemetry.io/otel to v1.41.0 [security] #42

2026-10-12T20:34:44+02:00

renovate-bot Bot commented

2026-10-12 20:34:44 +02:00

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/otel	`v1.39.0` → `v1.41.0`

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

CVE-2026-29181 / GHSA-mh2q-q3fh-2475 / GO-2026-5506

More information

Details

multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many baggage: header lines, even when each individual value is within the 8192-byte per-value parse limit.

severity

HIGH (availability / remote request amplification)

relevant links

repository: https://github.com/open-telemetry/opentelemetry-go
pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58

vulnerability details

pins: open-telemetry/opentelemetry-go@1ee4a4126d
as-of: 2026-02-04
policy: direct (no program scope provided)

callsite: propagation/baggage.go:58 (extractMultiBaggage)
attacker control: inbound HTTP request headers (many baggage field-values) → propagation.HeaderCarrier.Values("baggage") → repeated baggage.Parse + member aggregation

root cause

extractMultiBaggage iterates over all baggage header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit).

impact

in a default net/http configuration (max header bytes 1mb), a single request with many baggage: header field-values can cause large per-request allocations and increased latency.

example from the attached PoC harness (darwin/arm64; 80 values; 40 requests):

canonical: per_req_alloc_bytes=10315458 and p95_ms=7
control: per_req_alloc_bytes=133429 and p95_ms=0

proof of concept

canonical:

mkdir -p poc
unzip poc.zip -d poc
cd poc
make test

output (excerpt):

[CALLSITE_HIT]: propagation/baggage.go:58 extractMultiBaggage
[PROOF_MARKER]: baggage_multi_value_amplification p95_ms=7 per_req_alloc_bytes=10315458 per_req_allocs=16165

control:

cd poc
make control

control output (excerpt):

[NC_MARKER]: baggage_single_value_baseline p95_ms=0 per_req_alloc_bytes=133429 per_req_allocs=480

expected: multiple baggage header field-values should be semantically equivalent to a single comma-joined baggage value and should not multiply parsing/alloc work within the effective header byte budget.
actual: multiple baggage header field-values trigger repeated parsing and member aggregation, causing high per-request allocations and increased latency even when each individual value is within 8192 bytes.

fix recommendation

avoid repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing. one mitigation approach is to treat multi-values as a single comma-joined string and cap total parsed bytes (for example 8192 bytes total).

fix accepted when: under the default PoC harness settings, canonical stays within 2x of control for per_req_alloc_bytes and per_req_allocs, and p95_ms stays below 2ms.

poc.zip
PR_DESCRIPTION.md

Severity

CVSS Score: 7.5 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel

CVE-2026-29181 / GHSA-mh2q-q3fh-2475 / GO-2026-5506

More information

Details

OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel

Severity

Unknown

References

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)

`v1.41.0`

Compare Source

Added

Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
Add the go.opentelemetry.io/otel/semconv/v1.42.0 package.
The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions.
See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.
The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions.
See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

Changed

HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

Deprecated

Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

Removed

⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

Fixed

Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)
Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in go.opentelemetry.io/otel/attribute. (#8402)
Fix histogram data point reuse in go.opentelemetry.io/otel/sdk/metric aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. (#8403)
Avoid preallocating scope attributes when they are disabled in go.opentelemetry.io/otel/exporters/prometheus. (#8404)
Support HTTP-date values in the HTTP Retry-After header when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8417)
Reduce histogram heap allocations by reusing BucketCounts and Exemplars slices across Collect cycles in the cumulative histogram aggregation in go.opentelemetry.io/otel/sdk/metric. (#8428)
Fix go.opentelemetry.io/otel/exporters/stdout/stdouttrace self-observability to record error.type on the operation-duration histogram when the exportedSpans metric is disabled. (#8432)
Stop including trace exporter endpoint configuration in internal logs from go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, and go.opentelemetry.io/otel/exporters/zipkin. (#8438)
Fix invalid error formatting for out-of-range JSON code values in go.opentelemetry.io/otel/codes. (#8497)
Clarify in go.opentelemetry.io/otel/log that Logger.Enabled should be checked for every log emission because its result may change over time. (#8565)
Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in go.opentelemetry.io/otel/sdk/log. (#8566)
Make WithAttributeCountLimit(0) and OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0 discard all log record attributes in go.opentelemetry.io/otel/sdk/log. (#8570)
Clarify that the Record methods of Float64Histogram and Int64Histogram in go.opentelemetry.io/otel/metric expect non-negative values. (#8574)
Clarify in go.opentelemetry.io/otel/log that LoggerProvider implementations should retain an empty Logger name instead of replacing it with a default. (#8587)
Ensure that the built-in processors in go.opentelemetry.io/otel/sdk/log call exporter ForceFlush during Shutdown. (#8599)
Prevent processor operations in go.opentelemetry.io/otel/sdk/log from overlapping with processor shutdown or running after LoggerProvider shutdown. (#8608)
Prevent BatchProcessor in go.opentelemetry.io/otel/sdk/log from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. (#8620)
Make BatchProcessor in go.opentelemetry.io/otel/sdk/log return errors encountered while draining records during ForceFlush and Shutdown, while continuing to attempt later batches as long as the request context remains valid. (#8620)
Keep the default BatchProcessor maximum export batch size in go.opentelemetry.io/otel/sdk/log at or below the configured maximum queue size. (#8620)

`v1.40.0`

Compare Source

Added

Add ByteSlice and ByteSliceValue functions for new BYTESLICE attribute type in go.opentelemetry.io/otel/attribute. (#7948)
Apply attribute value limit to the KindBytes attribute type in go.opentelemetry.io/otel/sdk/log. (#7990)
Apply attribute value limit to the BYTESLICE attribute type in go.opentelemetry.io/otel/sdk/trace. (#7990)
Support BYTESLICE attributes in go.opentelemetry.io/otel/trace. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8153)
Support BYTESLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8153)
Add String method for Value type in go.opentelemetry.io/otel/attribute. (#8142)
Add Slice and SliceValue functions for new SLICE attribute type in go.opentelemetry.io/otel/attribute. (#8166)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8216)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8216)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8216)
Support SLICE attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8216)
Apply AttributeValueLengthLimit to attribute.SLICE type attribute values in go.opentelemetry.io/otel/sdk/trace, recursively truncating contained string values. (#8217)
Add Error field on Record type in go.opentelemetry.io/otel/log/logtest. (#8148)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8157)
Add WithMaxRequestSize option in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8157)
Add Settable to go.opentelemetry.io/otel/metric/x to allow reusing attribute options. (#8178)
Add experimental support for splitting metric data across multiple batches in go.opentelemetry.io/otel/sdk/metric.
Set OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size> to enable for all periodic readers.
See go.opentelemetry.io/otel/sdk/metric/internal/x for feature documentation. (#8071)
Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc.
Enable with OTEL_GO_X_OBSERVABILITY=true environment variable.
See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x for feature documentation. (#8192)
Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp.
Enable with OTEL_GO_X_OBSERVABILITY=true environment variable.
See go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x for feature documentation. (#8194)
Add experimental self-observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutlog.
Enable with OTEL_GO_X_OBSERVABILITY=true environment variable.
See go.opentelemetry.io/otel/stdout/stdoutlog/internal/x for feature documentation. (#8263)
Add WithDefaultAttributes to go.opentelemetry.io/otel/metric/x to support setting default attributes on instruments. (#8135)
Add go.opentelemetry.io/otel/semconv/v1.41.0 package.
The package contains semantic conventions from the v1.41.0 version of the OpenTelemetry Semantic Conventions.
See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.40.0. (#8324)
Add Observable variants of instruments to go.opentelemetry.io/otel/semconv/v1.41.0 package. (#8350)
Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in go.opentelemetry.io/otel/semconv/v1.41.0. (#8002)

Changed

⚠️ Breaking Change: go.opentelemetry.io/otel/sdk/metric now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation.
New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing attribute.Bool("otel.metric.overflow", true).
This can break users who relied on the previous unlimited default.
Set WithCardinalityLimit(0) or the deprecated OTEL_GO_X_CARDINALITY_LIMIT=0 environment variable to preserve unlimited cardinality.
Note that support for OTEL_GO_X_CARDINALITY_LIMIT may be removed in a future release. (#8247)
ErrorType in go.opentelemetry.io/otel/semconv now unwraps errors created with fmt.Errorf when deriving the error.type attribute. (#8133)
go.opentelemetry.io/otel/sdk/log now unwraps error chains created with fmt.Errorf when deriving the error.type attribute from errors on log records. (#8133)
Set.MarshalLog method in go.opentelemetry.io/otel/attribute now uses Value.String formatting following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#8169)
Optimize go.opentelemetry.io/otel/sdk/metric to return a drop reservoir and short-circuit Offer calls to the exemplar reservoir when exemplar.AlwaysOffFilter is configured. (#8211) (#8267)
Optimize go.opentelemetry.io/otel/sdk/metric to return a drop reservoir for asynchronous instruments when exemplar.TraceBasedFilter is configured. (#8286)

Deprecated

Deprecate Value.Emit method in go.opentelemetry.io/otel/attribute.
Use Value.String instead. (#8176)

Fixed

Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Limit OTLP request size to 64 MiB by default in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp.
The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new WithMaxRequestSize option. (#8157, #8365)
Fix gzipped request body replay on redirect in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8135)
Fix gzipped request body replay on redirect in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8152)
go.opentelemetry.io/otel/exporters/prometheus now uses Value.String formatting for label values following the OpenTelemetry AnyValue representation for non-OTLP protocols. (#8170)
Propagate errors from the exporter when calling Shutdown on BatchSpanProcessor in go.opentelemetry.io/otel/sdk/trace. (#8197)
Fix stale status code reporting on self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8226)
Fix a concurrent Collect data race and potential panic in go.opentelemetry.io/otel/exporters/prometheus when WithResourceAsConstantLabels option is used. (#8227)
Fix race condition in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by reverting #7447. (#8249)
Fix FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar to safely handle zero size.
A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in Offer() and Collect() ensure no-op behavior. (#8295)
Fix counting of spans and logs in self-observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8254)
Drop conflicting scope attributes named name, version, or schema_url from metric labels in go.opentelemetry.io/otel/exporters/prometheus, preserving the dedicated otel_scope_name, otel_scope_version, and otel_scope_schema_url labels. (#8264)
Close schema files opened by ParseFile in go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1. (GHSA-995v-fvrw-c78m)
Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in go.opentelemetry.io/otel/baggage and go.opentelemetry.io/otel/propagation. (#8222)
Fix go.opentelemetry.io/otel/semconv/v1.41.0 to include Attr* helper methods for required attributes on observable instruments. (#8361)
Limit baggage extraction error reporting in go.opentelemetry.io/otel/propagation to prevent malformed or oversized baggage headers from flooding logs. (GHSA-5wrp-cwcj-q835)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `v1.39.0` → `v1.41.0` | ![age](https://developer.mend.io/api/mc/badges/age/go/go.opentelemetry.io%2fotel/v1.41.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/go/go.opentelemetry.io%2fotel/v1.39.0/v1.41.0?slim=true) | --- ### OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) [CVE-2026-29181](https://nvd.nist.gov/vuln/detail/CVE-2026-29181) / [GHSA-mh2q-q3fh-2475](https://github.com/advisories/GHSA-mh2q-q3fh-2475) / [GO-2026-5506](https://pkg.go.dev/vuln/GO-2026-5506) <details> <summary>More information</summary> #### Details multi-value `baggage:` header extraction parses each header field-value independently and aggregates members across values. this allows an attacker to amplify cpu and allocations by sending many `baggage:` header lines, even when each individual value is within the 8192-byte per-value parse limit. ##### severity HIGH (availability / remote request amplification) ##### relevant links - repository: https://github.com/open-telemetry/opentelemetry-go - pinned callsite: https://github.com/open-telemetry/opentelemetry-go/blob/1ee4a4126dbdd1bc79e9fae072fa488beffac52a/propagation/baggage.go#L58 ##### vulnerability details **pins:** open-telemetry/opentelemetry-go@1ee4a4126dbdd1bc79e9fae072fa488beffac52a **as-of:** 2026-02-04 **policy:** direct (no program scope provided) **callsite:** propagation/baggage.go:58 (`extractMultiBaggage`) **attacker control:** inbound HTTP request headers (many `baggage` field-values) → `propagation.HeaderCarrier.Values("baggage")` → repeated `baggage.Parse` + member aggregation ##### root cause `extractMultiBaggage` iterates over all `baggage` header field-values and parses each one independently, then appends members into a shared slice. the 8192-byte parsing cap applies per header value, but the multi-value path repeats that work once per header line (bounded only by the server/proxy header byte limit). ##### impact in a default `net/http` configuration (max header bytes 1mb), a single request with many `baggage:` header field-values can cause large per-request allocations and increased latency. example from the attached PoC harness (darwin/arm64; 80 values; 40 requests): - canonical: `per_req_alloc_bytes=10315458` and `p95_ms=7` - control: `per_req_alloc_bytes=133429` and `p95_ms=0` ##### proof of concept canonical: ```bash mkdir -p poc unzip poc.zip -d poc cd poc make test ``` output (excerpt): ``` [CALLSITE_HIT]: propagation/baggage.go:58 extractMultiBaggage [PROOF_MARKER]: baggage_multi_value_amplification p95_ms=7 per_req_alloc_bytes=10315458 per_req_allocs=16165 ``` control: ```bash cd poc make control ``` control output (excerpt): ``` [NC_MARKER]: baggage_single_value_baseline p95_ms=0 per_req_alloc_bytes=133429 per_req_allocs=480 ``` **expected:** multiple `baggage` header field-values should be semantically equivalent to a single comma-joined `baggage` value and should not multiply parsing/alloc work within the effective header byte budget. **actual:** multiple `baggage` header field-values trigger repeated parsing and member aggregation, causing high per-request allocations and increased latency even when each individual value is within 8192 bytes. ##### fix recommendation avoid repeated parsing across multi-values by enforcing a global budget and/or normalizing multi-values into a single value before parsing. one mitigation approach is to treat multi-values as a single comma-joined string and cap total parsed bytes (for example 8192 bytes total). **fix accepted when:** under the default PoC harness settings, canonical stays within 2x of control for `per_req_alloc_bytes` and `per_req_allocs`, and `p95_ms` stays below 2ms. [poc.zip](https://github.com/user-attachments/files/25079945/poc.zip) [PR_DESCRIPTION.md](https://github.com/user-attachments/files/25079946/PR_DESCRIPTION.md) #### Severity - CVSS Score: 7.5 / 10 (High) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475) - [https://nvd.nist.gov/vuln/detail/CVE-2026-29181](https://nvd.nist.gov/vuln/detail/CVE-2026-29181) - [https://github.com/open-telemetry/opentelemetry-go/pull/7880](https://github.com/open-telemetry/opentelemetry-go/pull/7880) - [https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f](https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f) - [https://github.com/open-telemetry/opentelemetry-go](https://github.com/open-telemetry/opentelemetry-go) - [https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-mh2q-q3fh-2475) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel [CVE-2026-29181](https://nvd.nist.gov/vuln/detail/CVE-2026-29181) / [GHSA-mh2q-q3fh-2475](https://github.com/advisories/GHSA-mh2q-q3fh-2475) / [GO-2026-5506](https://pkg.go.dev/vuln/GO-2026-5506) <details> <summary>More information</summary> #### Details OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel #### Severity Unknown #### References - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475) - [https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f](https://github.com/open-telemetry/opentelemetry-go/commit/aa1894e09e3fe66860c7885cb40f98901b35277f) - [https://github.com/open-telemetry/opentelemetry-go/pull/7880](https://github.com/open-telemetry/opentelemetry-go/pull/7880) - [https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0](https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.41.0) This data is provided by [OSV](https://osv.dev/vulnerability/GO-2026-5506) and the [Go Vulnerability Database](https://github.com/golang/vulndb) ([CC-BY 4.0](https://github.com/golang/vulndb#license)). </details> --- ### Release Notes <details> <summary>open-telemetry/opentelemetry-go (go.opentelemetry.io/otel)</summary> ### [`v1.41.0`](https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/CHANGELOG.md#1450067002100018---2026-08-03) [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.40.0...v1.41.0) ##### Added - Add experimental observability metrics to `BatchProcessor` in `go.opentelemetry.io/otel/sdk/log`. ([#7124](https://github.com/open-telemetry/opentelemetry-go/issues/7124)) - Add the experimental `WithUnsafeAttributes` no-copy attribute option to `go.opentelemetry.io/otel/metric/x` for future performance improvements. This API is a work in progress. ([#8251](https://github.com/open-telemetry/opentelemetry-go/issues/8251)) - Add `Map` and `MapValue` functions for the new `MAP` attribute type in `go.opentelemetry.io/otel/attribute`. ([#8445](https://github.com/open-telemetry/opentelemetry-go/issues/8445)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Support `MAP` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#8453](https://github.com/open-telemetry/opentelemetry-go/issues/8453)) - Apply `AttributeValueLengthLimit` recursively to values contained in `attribute.MAP` attributes in `go.opentelemetry.io/otel/sdk/trace`. ([#8454](https://github.com/open-telemetry/opentelemetry-go/issues/8454)) - Remove duplicate keys from `attribute.MAP` values in `go.opentelemetry.io/otel/sdk/resource` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Remove duplicate keys by default from `attribute.MAP` values in instrumentation scope attributes in `go.opentelemetry.io/otel/sdk/log` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Remove duplicate keys by default from `attribute.MAP` values in span, event, link, and instrumentation scope attributes in `go.opentelemetry.io/otel/sdk/trace` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Remove duplicate keys by default from `attribute.MAP` values in measurement and instrumentation scope attributes in `go.opentelemetry.io/otel/sdk/metric` using last-value-wins semantics. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Extend `WithAllowKeyDuplication` in `go.opentelemetry.io/otel/sdk/log` to disable duplicate-key removal in `attribute.MAP` values for instrumentation scope attributes. ([#8471](https://github.com/open-telemetry/opentelemetry-go/issues/8471)) - Add the `go.opentelemetry.io/otel/semconv/v1.42.0` package. The package contains semantic conventions from the `v1.42.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.42.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.41.0`. ([#8484](https://github.com/open-telemetry/opentelemetry-go/issues/8484)) - Add `WithoutPanicRecording` as a `TracerProviderOption` in `go.opentelemetry.io/otel/sdk/trace` to disable exception event recording for panics. ([#8532](https://github.com/open-telemetry/opentelemetry-go/issues/8532)) - Add the `go.opentelemetry.io/otel/semconv/v1.43.0` package. The package contains semantic conventions from the `v1.43.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.43.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.42.0`. ([#8628](https://github.com/open-telemetry/opentelemetry-go/issues/8628)) ##### Changed - `HistogramReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` now uses a time-unbiased sampling algorithm for exemplars. ([#8306](https://github.com/open-telemetry/opentelemetry-go/issues/8306)) - ⚠️ **Breaking Change:** Use `go.opentelemetry.io/otel/attribute.Value` and `go.opentelemetry.io/otel/attribute.KeyValue` for log bodies and attributes in `go.opentelemetry.io/otel/log`, `go.opentelemetry.io/otel/log/logtest`, `go.opentelemetry.io/otel/sdk/log`, and `go.opentelemetry.io/otel/sdk/log/logtest`. ([#8490](https://github.com/open-telemetry/opentelemetry-go/issues/8490)) - Encode log bodies and attributes as `go.opentelemetry.io/otel/attribute.Value` JSON in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. ([#8490](https://github.com/open-telemetry/opentelemetry-go/issues/8490)) - Improve the performance of hashing `BOOLSLICE`, `INT64SLICE`, `FLOAT64SLICE`, and `STRINGSLICE` attribute values by avoiding reflection for short slices in `go.opentelemetry.io/otel/attribute`. ([#8511](https://github.com/open-telemetry/opentelemetry-go/issues/8511)) - ⚠️ **Breaking Change:** `WithEndpointURL` in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp` no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` and with setting the endpoint through `OTEL_EXPORTER_OTLP_METRICS_ENDPOINT`. If the URL has no path component, the root path (`/`) is used. Use `WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics"))` to preserve the previous behavior. ([#8538](https://github.com/open-telemetry/opentelemetry-go/issues/8538)) - ⚠️ **Breaking Change:** `WithEndpointURL` in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp` and with setting the endpoint through `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT`. If the URL has no path component, the root path (`/`) is used. Use `WithEndpointURL(url.JoinPath(endpoint, "/v1/traces"))` to preserve the previous behavior. ([#8538](https://github.com/open-telemetry/opentelemetry-go/issues/8538)) ##### Deprecated - Deprecate `WithExportBufferSize` in `go.opentelemetry.io/otel/sdk/log`. The option remains available for source compatibility but no longer affects behavior; `BatchProcessor` no longer maintains a separate export-request buffer. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) ##### Removed - ⚠️ **Breaking Change:** Remove `Kind`, `Value`, `KeyValue`, their constructors, and attribute conversion helpers from `go.opentelemetry.io/otel/log`. ([#8490](https://github.com/open-telemetry/opentelemetry-go/issues/8490)) - ⚠️ **Breaking Change:** Remove the `AttributeValueLengthLimit` and `AttributeCountLimit` fields from `RecordFactory` in `go.opentelemetry.io/otel/sdk/log/logtest`; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. ([#8556](https://github.com/open-telemetry/opentelemetry-go/issues/8556)) ##### Fixed - Apply TLS certificates configured through environment variables to gRPC connections in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. - Prevent panics in `go.opentelemetry.io/otel/bridge/opentracing` when OpenTracing baggage is propagated concurrently with `Span.SetBaggageItem`. - Fix an off-by-one error in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` that prevented the first exemplar from being sampled after the reservoir was filled. ([#8309](https://github.com/open-telemetry/opentelemetry-go/issues/8309)) - Interpret HTTP `Retry-After` header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8383](https://github.com/open-telemetry/opentelemetry-go/issues/8383)) - Fix a memory leak in the `Reservoir` implementation in `go.opentelemetry.io/otel/sdk/metric/exemplar`, where storing the full `context.Context` pinned large objects such as gRPC transport buffers. ([#8389](https://github.com/open-telemetry/opentelemetry-go/issues/8389)) - Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in `go.opentelemetry.io/otel/attribute`. ([#8402](https://github.com/open-telemetry/opentelemetry-go/issues/8402)) - Fix histogram data point reuse in `go.opentelemetry.io/otel/sdk/metric` aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. ([#8403](https://github.com/open-telemetry/opentelemetry-go/issues/8403)) - Avoid preallocating scope attributes when they are disabled in `go.opentelemetry.io/otel/exporters/prometheus`. ([#8404](https://github.com/open-telemetry/opentelemetry-go/issues/8404)) - Support HTTP-date values in the HTTP `Retry-After` header when retrying OTLP HTTP exports in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8417](https://github.com/open-telemetry/opentelemetry-go/issues/8417)) - Reduce histogram heap allocations by reusing `BucketCounts` and `Exemplars` slices across `Collect` cycles in the cumulative histogram aggregation in `go.opentelemetry.io/otel/sdk/metric`. ([#8428](https://github.com/open-telemetry/opentelemetry-go/issues/8428)) - Fix `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` self-observability to record `error.type` on the operation-duration histogram when the `exportedSpans` metric is disabled. ([#8432](https://github.com/open-telemetry/opentelemetry-go/issues/8432)) - Stop including trace exporter endpoint configuration in internal logs from `go.opentelemetry.io/otel/sdk/trace`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, and `go.opentelemetry.io/otel/exporters/zipkin`. ([#8438](https://github.com/open-telemetry/opentelemetry-go/issues/8438)) - Fix invalid error formatting for out-of-range JSON code values in `go.opentelemetry.io/otel/codes`. ([#8497](https://github.com/open-telemetry/opentelemetry-go/issues/8497)) - Clarify in `go.opentelemetry.io/otel/log` that `Logger.Enabled` should be checked for every log emission because its result may change over time. ([#8565](https://github.com/open-telemetry/opentelemetry-go/issues/8565)) - Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in `go.opentelemetry.io/otel/sdk/log`. ([#8566](https://github.com/open-telemetry/opentelemetry-go/issues/8566)) - Make `WithAttributeCountLimit(0)` and `OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0` discard all log record attributes in `go.opentelemetry.io/otel/sdk/log`. ([#8570](https://github.com/open-telemetry/opentelemetry-go/issues/8570)) - Clarify that the `Record` methods of `Float64Histogram` and `Int64Histogram` in `go.opentelemetry.io/otel/metric` expect non-negative values. ([#8574](https://github.com/open-telemetry/opentelemetry-go/issues/8574)) - Clarify in `go.opentelemetry.io/otel/log` that `LoggerProvider` implementations should retain an empty `Logger` name instead of replacing it with a default. ([#8587](https://github.com/open-telemetry/opentelemetry-go/issues/8587)) - Ensure that the built-in processors in `go.opentelemetry.io/otel/sdk/log` call exporter `ForceFlush` during `Shutdown`. ([#8599](https://github.com/open-telemetry/opentelemetry-go/issues/8599)) - Prevent processor operations in `go.opentelemetry.io/otel/sdk/log` from overlapping with processor shutdown or running after `LoggerProvider` shutdown. ([#8608](https://github.com/open-telemetry/opentelemetry-go/issues/8608)) - Prevent `BatchProcessor` in `go.opentelemetry.io/otel/sdk/log` from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) - Make `BatchProcessor` in `go.opentelemetry.io/otel/sdk/log` return errors encountered while draining records during `ForceFlush` and `Shutdown`, while continuing to attempt later batches as long as the request context remains valid. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) - Keep the default `BatchProcessor` maximum export batch size in `go.opentelemetry.io/otel/sdk/log` at or below the configured maximum queue size. ([#8620](https://github.com/open-telemetry/opentelemetry-go/issues/8620)) ### [`v1.40.0`](https://github.com/open-telemetry/opentelemetry-go/blob/HEAD/CHANGELOG.md#1440066002000017-2026-05-27) [Compare Source](https://github.com/open-telemetry/opentelemetry-go/compare/v1.39.0...v1.40.0) ##### Added - Add `ByteSlice` and `ByteSliceValue` functions for new `BYTESLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#7948](https://github.com/open-telemetry/opentelemetry-go/issues/7948)) - Apply attribute value limit to the `KindBytes` attribute type in `go.opentelemetry.io/otel/sdk/log`. ([#7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Apply attribute value limit to the `BYTESLICE` attribute type in `go.opentelemetry.io/otel/sdk/trace`. ([#7990](https://github.com/open-telemetry/opentelemetry-go/issues/7990)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/trace`. ([#8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Support `BYTESLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#8153](https://github.com/open-telemetry/opentelemetry-go/issues/8153)) - Add `String` method for `Value` type in `go.opentelemetry.io/otel/attribute`. ([#8142](https://github.com/open-telemetry/opentelemetry-go/issues/8142)) - Add `Slice` and `SliceValue` functions for new `SLICE` attribute type in `go.opentelemetry.io/otel/attribute`. ([#8166](https://github.com/open-telemetry/opentelemetry-go/issues/8166)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlptrace`. ([#8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlplog`. ([#8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric`. ([#8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Support `SLICE` attributes in `go.opentelemetry.io/otel/exporters/zipkin`. ([#8216](https://github.com/open-telemetry/opentelemetry-go/issues/8216)) - Apply `AttributeValueLengthLimit` to `attribute.SLICE` type attribute values in `go.opentelemetry.io/otel/sdk/trace`, recursively truncating contained string values. ([#8217](https://github.com/open-telemetry/opentelemetry-go/issues/8217)) - Add `Error` field on `Record` type in `go.opentelemetry.io/otel/log/logtest`. ([#8148](https://github.com/open-telemetry/opentelemetry-go/issues/8148)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `WithMaxRequestSize` option in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157)) - Add `Settable` to `go.opentelemetry.io/otel/metric/x` to allow reusing attribute options. ([#8178](https://github.com/open-telemetry/opentelemetry-go/issues/8178)) - Add experimental support for splitting metric data across multiple batches in `go.opentelemetry.io/otel/sdk/metric`. Set `OTEL_GO_X_METRIC_EXPORT_BATCH_SIZE=<max_size>` to enable for all periodic readers. See `go.opentelemetry.io/otel/sdk/metric/internal/x` for feature documentation. ([#8071](https://github.com/open-telemetry/opentelemetry-go/issues/8071)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. Enable with `OTEL_GO_X_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc/internal/x` for feature documentation. ([#8192](https://github.com/open-telemetry/opentelemetry-go/issues/8192)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. Enable with `OTEL_GO_X_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp/internal/x` for feature documentation. ([#8194](https://github.com/open-telemetry/opentelemetry-go/issues/8194)) - Add experimental self-observability metrics in `go.opentelemetry.io/otel/exporters/stdout/stdoutlog`. Enable with `OTEL_GO_X_OBSERVABILITY=true` environment variable. See `go.opentelemetry.io/otel/stdout/stdoutlog/internal/x` for feature documentation. ([#8263](https://github.com/open-telemetry/opentelemetry-go/issues/8263)) - Add `WithDefaultAttributes` to `go.opentelemetry.io/otel/metric/x` to support setting default attributes on instruments. ([#8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Add `go.opentelemetry.io/otel/semconv/v1.41.0` package. The package contains semantic conventions from the `v1.41.0` version of the OpenTelemetry Semantic Conventions. See the [migration documentation](./semconv/v1.41.0/MIGRATION.md) for information on how to upgrade from `go.opentelemetry.io/otel/semconv/v1.40.0`. ([#8324](https://github.com/open-telemetry/opentelemetry-go/issues/8324)) - Add Observable variants of instruments to `go.opentelemetry.io/otel/semconv/v1.41.0` package. ([#8350](https://github.com/open-telemetry/opentelemetry-go/issues/8350)) - Generate explicit histogram bucket boundaries from weaver configuration for HTTP and RPC duration instruments in `go.opentelemetry.io/otel/semconv/v1.41.0`. ([#8002](https://github.com/open-telemetry/opentelemetry-go/issues/8002)) ##### Changed - ⚠️ **Breaking Change:** `go.opentelemetry.io/otel/sdk/metric` now applies a default cardinality limit of 2000 to comply with the Metrics SDK specification recommendation. New attribute sets are dropped when the cardinality limit is reached. The measurement of these sets are aggregated into a special attribute set containing `attribute.Bool("otel.metric.overflow", true)`. This can break users who relied on the previous unlimited default. Set `WithCardinalityLimit(0)` or the deprecated `OTEL_GO_X_CARDINALITY_LIMIT=0` environment variable to preserve unlimited cardinality. Note that support for `OTEL_GO_X_CARDINALITY_LIMIT` may be removed in a future release. ([#8247](https://github.com/open-telemetry/opentelemetry-go/issues/8247)) - `ErrorType` in `go.opentelemetry.io/otel/semconv` now unwraps errors created with `fmt.Errorf` when deriving the `error.type` attribute. ([#8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `go.opentelemetry.io/otel/sdk/log` now unwraps error chains created with `fmt.Errorf` when deriving the `error.type` attribute from errors on log records. ([#8133](https://github.com/open-telemetry/opentelemetry-go/issues/8133)) - `Set.MarshalLog` method in `go.opentelemetry.io/otel/attribute` now uses `Value.String` formatting following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#8169](https://github.com/open-telemetry/opentelemetry-go/issues/8169)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir and short-circuit `Offer` calls to the exemplar reservoir when `exemplar.AlwaysOffFilter` is configured. ([#8211](https://github.com/open-telemetry/opentelemetry-go/issues/8211)) ([#8267](https://github.com/open-telemetry/opentelemetry-go/issues/8267)) - Optimize `go.opentelemetry.io/otel/sdk/metric` to return a drop reservoir for asynchronous instruments when `exemplar.TraceBasedFilter` is configured. ([#8286](https://github.com/open-telemetry/opentelemetry-go/issues/8286)) ##### Deprecated - Deprecate `Value.Emit` method in `go.opentelemetry.io/otel/attribute`. Use `Value.String` instead. ([#8176](https://github.com/open-telemetry/opentelemetry-go/issues/8176)) ##### Fixed - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Limit OTLP request size to 64 MiB by default in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. The limit applies before compression, oversized requests are treated as non-retryable errors, and the limit can be configured with the new `WithMaxRequestSize` option. ([#8157](https://github.com/open-telemetry/opentelemetry-go/issues/8157), [#8365](https://github.com/open-telemetry/opentelemetry-go/issues/8365)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp`. ([#8135](https://github.com/open-telemetry/opentelemetry-go/issues/8135)) - Fix gzipped request body replay on redirect in `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8152](https://github.com/open-telemetry/opentelemetry-go/issues/8152)) - `go.opentelemetry.io/otel/exporters/prometheus` now uses `Value.String` formatting for label values following the [OpenTelemetry AnyValue representation for non-OTLP protocols](https://opentelemetry.io/docs/specs/otel/common/#anyvalue). ([#8170](https://github.com/open-telemetry/opentelemetry-go/issues/8170)) - Propagate errors from the exporter when calling `Shutdown` on `BatchSpanProcessor` in `go.opentelemetry.io/otel/sdk/trace`. ([#8197](https://github.com/open-telemetry/opentelemetry-go/issues/8197)) - Fix stale status code reporting on self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8226](https://github.com/open-telemetry/opentelemetry-go/issues/8226)) - Fix a concurrent `Collect` data race and potential panic in `go.opentelemetry.io/otel/exporters/prometheus` when `WithResourceAsConstantLabels` option is used. ([#8227](https://github.com/open-telemetry/opentelemetry-go/issues/8227)) - Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting [#7447](https://github.com/open-telemetry/opentelemetry-go/issues/7447). ([#8249](https://github.com/open-telemetry/opentelemetry-go/issues/8249)) - Fix `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` to safely handle zero size. A capacity check in the constructor initializes the reservoir safely and skips initialization for zero-cap; early returns in `Offer()` and `Collect()` ensure no-op behavior. ([#8295](https://github.com/open-telemetry/opentelemetry-go/issues/8295)) - Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. ([#8254](https://github.com/open-telemetry/opentelemetry-go/issues/8254)) - Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. ([#8264](https://github.com/open-telemetry/opentelemetry-go/issues/8264)) - Close schema files opened by `ParseFile` in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1`. ([GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m)) - Enforce the 8192-byte baggage size limit during extraction/parsing, changing behavior when the limit is exceeded in `go.opentelemetry.io/otel/baggage` and `go.opentelemetry.io/otel/propagation`. ([#8222](https://github.com/open-telemetry/opentelemetry-go/issues/8222)) - Fix `go.opentelemetry.io/otel/semconv/v1.41.0` to include `Attr*` helper methods for required attributes on observable instruments. ([#8361](https://github.com/open-telemetry/opentelemetry-go/issues/8361)) - Limit baggage extraction error reporting in `go.opentelemetry.io/otel/propagation` to prevent malformed or oversized baggage headers from flooding logs. ([GHSA-5wrp-cwcj-q835](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot Bot added 1 commit 2026-10-12 20:34:44 +02:00

chore(deps): update module go.opentelemetry.io/otel to v1.41.0 [security]

CI / Checks (pull_request) Successful in 29s

Details

PR title / Conventional title (pull_request) Successful in 2s

Details

222dde70c5

renovate-bot Bot scheduled this pull request to auto merge when all checks succeed 2026-10-12 20:34:45 +02:00

renovate-bot Bot commented

2026-10-12 20:34:45 +02:00

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

2 additional dependencies were updated

Details:

Package	Change
`go.opentelemetry.io/otel/metric`	`v1.39.0` -> `v1.41.0`
`go.opentelemetry.io/otel/trace`	`v1.39.0` -> `v1.41.0`

### ℹ️ Artifact update notice ##### File name: go.mod In order to perform the update(s) described in the table above, Renovate ran the `go get` command, which resulted in the following additional change(s): - 2 additional dependencies were updated Details: | **Package** | **Change** | | :-------------------------------- | :--------------------- | | `go.opentelemetry.io/otel/metric` | `v1.39.0` -> `v1.41.0` | | `go.opentelemetry.io/otel/trace` | `v1.39.0` -> `v1.41.0` |

renovate-bot Bot merged commit 915d8bf3bd into main

2026-10-12 20:35:47 +02:00

renovate-bot Bot deleted branch renovate/go-go.opentelemetry.io-otel-vulnerability

2026-10-12 20:35:47 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: keb/lazysecrets#42

chore(deps): update module go.opentelemetry.io/otel to v1.41.0 [security] #42

OpenTelemetry-Go: multi-value baggage header extraction causes excessive allocations (remote dos amplification)

Details

severity

relevant links

vulnerability details

root cause

impact

proof of concept

fix recommendation

Severity

References

OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel

Details

Severity

References

Release Notes

v1.41.0

Added

Changed

Deprecated

Removed

Fixed

v1.40.0

Added

Changed

Deprecated

Fixed

Configuration

ℹ️ Artifact update notice

File name: go.mod

OpenTelemetry-Go: multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

`v1.41.0`

`v1.40.0`