Microsoft Flags OpenTelemetry-Go DoS Flaw: Patch Now to Block Header Bomb Attacks

On June 3, 2026, Microsoft published a high‑severity security advisory for CVE‑2026‑29181, a denial‑of‑service vulnerability in the Go implementation of OpenTelemetry. The bug allows remote attackers to crash or degrade services by sending HTTP requests with multiple baggage header values, causing excessive CPU and memory consumption. OpenTelemetry‑Go versions 1.36.0 through 1.40.0 are affected; the fix is in release 1.41.0.

What’s at Stake: How a Baggage Header Can Overwhelm Your Service

OpenTelemetry is the cloud‑native observability framework that powers distributed tracing, metrics, and logging across thousands of organizations. The Go SDK is used in everything from Kubernetes control planes to Azure Functions. The vulnerability sits in the baggage propagation code: when a request arrives with repeated baggage HTTP headers, the library parses each value independently before merging them. A per‑value size limit of 8,192 bytes exists, but an attacker can bypass it by sending many values, each under the limit, while the total work and memory sky‑rocket.

This is a classic amplification attack. The attacker’s request is cheap; the server’s processing is expensive. The CVSS score is 7.5 (High), with the vector string emphasizing network attack, low complexity, no privileges, and high availability impact. According to the official advisory, a proof of concept shows that a single request with many baggage values can force the Go runtime to allocate hundreds of megabytes and spike CPU, leading to timeouts, pod restarts, or a complete service brownout. There is no data theft, but the operational damage is real.

Who Should Care—and Why It’s Not Just a “Go Problem”

If you run any Go service that uses OpenTelemetry’s baggage propagator, you are directly exposed. But the blast radius extends far beyond individual developers.

For developers—If your go.mod file lists go.opentelemetry.io/otel at version 1.36.0 to 1.40.0 and your code extracts baggage from incoming requests, you need to update immediately. Even indirect dependencies matter: a framework or monitoring agent you pull in might transitively include the vulnerable library.

For platform engineers—Your Kubernetes clusters, sidecars, and CI/CD runners are likely full of Go binaries. OpenTelemetry‑Go is static‑linked, so a base image update won’t fix it; every container must be rebuilt. Check vendor‑supplied appliances and SaaS‑deployed agents as well.

For Windows administrators—This isn’t a Windows vulnerability in the traditional sense—you won’t get a Patch Tuesday fix. But if your environment runs Go‑based services under Azure, in Docker Desktop, or as part of a Windows‑hosted Kubernetes node, this CVE directly threatens the availability of those workloads. Microsoft’s decision to list it signals that modern Windows estates must track supply‑chain risks far beyond the operating system.

How We Got Here: Telemetry as Invisible Infrastructure

OpenTelemetry became a CNCF incubating project in 2021 and has since been adopted by AWS, Google Cloud, Azure, and most observability platforms. Its baggage mechanism was designed to pass metadata—tenant IDs, feature flags, routing keys—across microservices without altering business payloads. It’s a convenient side channel that developers often leave wide open because tracing is critical for debugging.

The vulnerability exploits a mismatch between HTTP’s design and a common developer assumption. HTTP allows multiple header fields with the same name; the OpenTelemetry‑Go parser enforced a per‑value limit but not a total‑cost budget. This is a recurring pattern in web security: size limits that ignore multiplicity lead to resource exhaustion. The fix aligns the limit with the actual work performed, capping the total parsed input rather than each fragment.

What to Do Now: A Practical Patch and Mitigation Plan

The primary remediation is to upgrade to OpenTelemetry‑Go 1.41.0 or later. Below is a step‑by‑step guide for applying the fix and buying time while you roll it out.

1. Scan for affected versions

Use your software composition analysis (SCA) tool or a simple shell command:

go list -m all | grep "go.opentelemetry.io/otel"

If the returned version is between 1.36.0 and 1.40.0, you’re vulnerable.

2. Update and rebuild

Run:

go get -u go.opentelemetry.io/[email protected]

Then rebuild all binaries and container images that include this dependency. Do not assume a rolling restart of pods will pick up a patched base image; Go’s static linking means you need a full rebuild.

3. Map your exposure

Identify every service that calls baggage.FromContext() or uses a composite propagator that includes Baggage. Prioritize internet‑facing and partner‑facing endpoints. A batch processor with no inbound HTTP path is far lower risk.

4. Apply edge mitigations while patching

If you can’t deploy the fix immediately, use your API gateway, ingress controller, or reverse proxy to:
- Drop repeated baggage headers entirely
- Cap the total header size to a reasonable limit (e.g., 8 KB)
- Strip baggage from external requests if your internal services don’t need it from untrusted sources

Be aware that dropping baggage may break legitimate tracing or feature‑flag workflows; coordinate with development teams first.

5. Monitor for active attacks

Look for sudden spikes in memory allocations, garbage collection pauses, or request latency. If your APM collects header‑sizes or counts repeated headers, set thresholds. Since the attack uses valid HTTP, it won’t trigger signature‑based WAF rules, so behavioral monitoring is essential.

Affected and Fixed Versions

The Broader Impact on Windows Environments

Microsoft’s own services—Azure Monitor, GitHub Actions, and various internal tools—have embraced OpenTelemetry. While the company hasn’t disclosed whether its first‑party offerings were affected, the advisory underscores that Windows shops must now treat open‑source SDKs as first‑class security assets. This means:

• Inventory everything. Your SCA tooling should cover Go modules, NuGet packages, and container images equally.
• Plan for static‑linked updates. A vulnerability in a statically linked library cannot be hot‑patched; rebuilds must be part of your delivery cycle.
• Collaborate across teams. The ops team may not know which Go services parse baggage; the dev team may not know which edge proxies can strip headers. Close the gap.

Outlook: Observability Code Is Production Code

CVE‑2026‑29181 is a wake‑up call. Telemetry SDKs sit in the request path, parse complex data, and often run with significant privileges. They are no longer “just monitoring.” Future incidents will likely target similar side‑channel parsers—trace context, OpenCensus, or custom headers. The defense must evolve:

• Treat observability headers as untrusted input at the boundary.
• Enforce total‑cost budgets, not just per‑field limits.
• Include telemetry libraries in threat models and incident response playbooks.

The fix for this CVE is trivial—update a module and rebuild. But the organizational work—assessing exposure, hardening the edge, and retooling monitoring—will pay dividends against the next header‑based attack. Patch this week, then schedule that baggage policy review. Your midnight on‑call rotation will thank you.