CVE-2026-128086

## Summary OpenTelemetry Go eagerly materializes W3C baggage metadata into property objects during parsing. Slice growth, serialization, and copying into the internal representation cause **bounded but disproportionate memory-allocation amplification** for a valid, densely populated header. In v1.46.0 and v1.47.0-rc.1, the 8,192-byte raw-input limit is checked before member parsing; this is not unlimited allocation or a bypass of that limit. A valid 8,191-byte value containing one member and 4,094 properties causes approximately 778 KB of cumulative allocation per parse. A corrected measurement with forced garbage collection before and after parsing retains approximately 164 KB per result while it remains live. These are different metrics: approximately 95 times the input in allocation traffic versus approximately 20 times in incremental live heap in the measured environment. The relevant security configuration is a service that enables Baggage propagation and extracts attacker-controlled inbound context before authentication or on a public route. Concurrent or sustained requests can increase allocation and GC pressure. The evidence establishes allocation amplification, but does not establish reliable OOM, process termination, or complete denial of service. This is a **pre-existing, independent allocation-amplification path not addressed by GHSA-5wrp-cwcj-q835 / CVE-2026-41178**. It predates that advisory; it is not described as having been introduced by its fix. ## Affected module, versions, and symbols - Go module: `go.opentelemetry.io/otel`. - Import paths and entry points: `go.opentelemetry.io/otel/baggage.Parse` and `go.opentelemetry.io/otel/propagation.Baggage.Extract`. - Implementation: `parseMember`, property-slice growth and serialization, and conversion into `internal/baggage.Item`. - Source history places the eager-property implementation at commit `4bf6150fa94e18bdf01c96ed78ee6d1c76f8e308`, first included in `v1.0.0-RC1`; the stable release line st