OpenTelemetry Python Jaeger propagator hit by DoS flaw CVE-2026-116694

CVE-2026-116694 (CVSS 6.3) in opentelemetry-propagator-jaeger before 1.45.0 lets an unauthenticated remote attacker exhaust CPU and memory via unbounded uberctx-* baggage headers. Version 1.45.0 applies W3C Baggage limits of 180 entries, 4,096 bytes per entry and 8,192 bytes total.

• Flaw CWE-770 affects opentelemetry-propagator-jaeger below 1.45.0
• CVSS 4.0 score is 6.3 with a network attack vector and no auth
• Patch 1.45.0 caps 180 entries, 4,096 B per entry, 8,192 B total
• POC test exists in the repo; no wild exploitation reported