CVE-2026-45292¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
A vulnerability in the baggage propagation implementation of opentelemetry-api and opentelemetry-extension-trace-propagators allows parsing of oversized baggage to cause unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. Fixed in 1.62.0.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0, 7.3.0
WSO2 JUSTIFICATION¶
The OpenTelemetry distribution shipped with WSO2 Identity Server is within the affected range, so the vulnerable baggage propagator is physically present. However, nothing in the product consumes it:
The propagator is unused. W3CBaggagePropagator is referenced by no component outside the OpenTelemetry bundle itself, and that bundle is the only importer of io.opentelemetry.api.baggage.
The only real consumer does not use baggage and is disabled by default. The Carbon user core component imports io.opentelemetry.api solely for LDAP span instrumentation, and that instrumentation is disabled in the shipped configuration (repository/conf/carbon.xml, Tracing/OpenTelemetry/LDAP/Enable is false).
As a result, no inbound baggage header is ever parsed by the product, and the unbounded allocation described in the advisory cannot be triggered.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.