GHSA-8988-4f7v-96qf moderate
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
Affected range
SEMVER: introduced 0; fixed 2.8.0Fixed versions: 2.8.0
OpenTelemetry Core provides constants and utilities shared by all OpenTelemetry SDK packages.
Evidence path
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
Latest version
2.12.0
No matching published advisory returned
Known exploitation
No KEV match
Checked by exact CVE identifier
Highest advisory severity
Moderate
1 active advisory
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Affected range
SEMVER: introduced 0; fixed 2.8.0Fixed versions: 2.8.0