AIKIDO-2026-174263

TL;DR

JaegerPropagator.extract() in opentelemetry-propagator-jaeger reads inbound uberctx-* baggage headers and rebuilds the baggage map without limiting the number of entries, the size of each entry, or the total payload size. A carrier that supplies many large baggage entries drives extra CPU work and short lived heap allocations on every extraction. Deployments that enable the optional Jaeger propagator and accept inbound propagation headers from untrusted callers see increased per request resource usage, which can contribute to denial of service when transport level header limits are absent or raised above the baggage limits. The fix limits extraction to 180 entries, 8192 bytes total, and skips entries larger than 4096 bytes.