fix(deps): update rust crate opentelemetry_sdk to 0.32.0 [security]

Details

Summary

BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce the W3C Baggage size limits before parsing an inbound baggage header. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits.

The SDK now applies limits aligned with the W3C Baggage limits:

• 64 list-members
• 8192 bytes total

Impact

Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits.

The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution.

Patches

Upgrade opentelemetry_sdk to version 0.32.1 or later.

Version 0.32.1 rejects baggage header values larger than 8192 bytes and limits extraction to the first 64 list-members.

Workarounds

If upgrading immediately is not possible, reject or limit inbound baggage headers larger than 8192 bytes before invoking OpenTelemetry propagation extraction. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.

Resources

• W3C Baggage limits: https://www.w3.org/TR/baggage/#limits
• Related OpenTelemetry Java advisory: https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx
• Related OpenTelemetry Go advisory: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-mh2q-q3fh-2475
• CVE-2026-48504

Credit

tonghuaroot

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx
• https://github.com/advisories/GHSA-w9wp-h8wv-79jx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v0.32.1

Released 2026-May-23

• BaggagePropagator now enforces the W3C Baggage maximum header length (8192 bytes) and maximum list-member count (64) when extracting an inbound baggage header. Headers exceeding 8192 bytes are dropped at the propagator boundary; headers with more than 64 list members are truncated to the first 64 entries. The change keeps the propagator from parsing attacker-controlled input beyond the W3C limits instead of doing per-entry parse, decode, and allocation work only to discard the excess on Baggage insert. See https://www.w3.org/TR/baggage/#limits.
• Reverted the SimpleSpanProcessor telemetry suppression added in 0.32.0 (see #​3494), which caused a RefCell already borrowed panic when a span was started and dropped inside a get_active_span (or Context::map_current) closure. Tracked in #​3510. A proper fix for the underlying Context::map_current re-entrancy will be investigated separately, after which the suppression can be safely re-applied.
• View-provided metric stream name (set via Stream::builder().with_name(...)) is no longer validated against the instrument name syntax, per spec clarification. unit and other stream parameters continue to be validated.

v0.32.0

Compare Source

Released 2026-May-08

• SimpleSpanProcessor now suppresses telemetry during export, preventing telemetry-induced-telemetry feedback loops. This aligns with the existing behavior in BatchSpanProcessor and SimpleLogProcessor.
• Removed SimpleConcurrentLogProcessor and the experimental_logs_concurrent_log_processor feature flag. The use cases it was designed for (ETW/user_events exporters) are better served by modeling those exporters as processors directly.
• Added Counter::bind() and Histogram::bind() SDK implementations that return pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>). Bound instruments resolve the attribute-to-aggregator mapping once at bind time and cache the result, eliminating per-call HashMap lookups. View attribute filtering is applied at bind time so the hot path stays free of per-call attribute processing. Bound and unbound recordings with the same (post-view) attribute set always aggregate into the same data point, including the empty attribute set. Bound entries are never evicted during delta collection while a handle exists — idle cycles produce no export but the tracker persists. If bind() is called at the cardinality limit, the handle binds directly to the overflow tracker — its writes stay on the same direct (no-lookup) hot path and consistently land in the otel.metric.overflow=true bucket for the lifetime of the handle. To recover a bound handle after delta collection frees space, drop the existing handle and call bind() again. Gated behind the experimental_metrics_bound_instruments feature flag. Benchmarks show ~28x speedup for counter operations and ~9x for histograms.
• Delta metrics collection now uses in-place eviction instead of draining the HashMap on every collect cycle. Stale attribute sets that received no measurements since the last collection are evicted. Note: recovery from cardinality overflow now requires 2 collect cycles — the first marks entries as stale, the second evicts them.
• Breaking The SDK testing feature is now runtime agnostic. #​3407
  • TokioSpanExporter and new_tokio_test_exporter have been renamed to TestSpanExporter and new_test_exporter.
  • The following transitive dependencies and features have been removed: tokio/rt, tokio/time, tokio/macros, tokio/rt-multi-thread, tokio-stream, experimental_async_runtime
• Store InstrumentationScope in Arc internally in SdkTracer, making tracer clones cheaper (Arc refcount increment instead of deep copy).
• Add 32-bit platform support by using portable-atomic for AtomicI64 and AtomicU64 in the metrics module. This enables compilation on 32-bit ARM targets (e.g., armv5te-unknown-linux-gnueabi, armv7-unknown-linux-gnueabihf).
• Aggregation enum and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.
• Fix service.name Resource attribute fallback to follow OpenTelemetry specification by using unknown_service:<process.executable.name> format when service name is not explicitly configured. Previously, it only used unknown_service.
• Fix SpanExporter::shutdown() default timeout from 5 nanoseconds to 5 seconds.
• Breaking SpanExporter trait methods shutdown, shutdown_with_timeout, and force_flush now take &self instead of &mut self for consistency with LogExporter and PushMetricExporter. Implementers using interior mutability (e.g., Mutex, AtomicBool) require no changes.
• Added Resource::get_ref(&self, key: &Key) -> Option<&Value> to allow retrieving a reference to a resource value without cloning.
• Breaking Removed the following public hidden methods from the SdkTracer #​3227:
  • id_generator, should_sample
• Breaking Moved the following SDK sampling types from opentelemetry::trace to opentelemetry_sdk::trace #​3277:
  • SamplingDecision, SamplingResult
  • These types are SDK implementation details and should be imported from opentelemetry_sdk::trace instead.
• StreamBuilder::build() now rejects usize::MAX as a cardinality limit with a validation error. #​3506
• Fix Histogram boundaries being ignored in the presence of views #​3312
• TracerProviderBuilder::with_sampler allows to pass boxed instance of ShouldSample [#​3313][3313]
• Fix ObservableCounter and ObservableUpDownCounter now correctly report only data points from the current measurement cycle, removing stale attribute combinations that are no longer observed. #​3248
• Fix panic when SpanProcessor::on_end calls Context::current() (#​3262).
  • Updated SpanProcessor::on_end documentation to clarify that Context::current() returns the parent context, not the span's context
• Fix traceparent headers with unknown flags (e.g. W3C random-trace-id flag 0x02) being incorrectly rejected. Unknown flags are now accepted and zeroed out as required by the W3C trace-context spec. #​3435
• Breaking InMemoryExporterError has been removed and replaced by OTelSdkError, and a new JaegerRemoteSamplerBuildError introduced to replace last uses of TraceError. #​3458
• "spec_unstable_logs_enabled" feature flag is removed. The capability (and the backing specification) is now stable and is enabled by default. #​3278