Security: CVE-2026-41178 — go.opentelemetry.io/otel/propagation v1.43.0 DoS via unbounded baggage header parsing

Description

Running a Twistlock / Prisma Cloud scan against temporalio/server:1.31.1 and temporalio/admin-tools:1.31.1 surfaces CVE-2026-41178 in the bundled go.opentelemetry.io/otel/propagation dependency.

Vulnerability details

Root cause

A change in open-telemetry/opentelemetry-go#7880 removed the raw-length cap on baggage header parsing. As a result, Parse() will process arbitrarily large or malformed baggage HTTP headers, causing excessive CPU/memory consumption and log amplification. Any Temporal service using the default OTel baggage propagator and accepting external HTTP traffic is exposed to availability impact.

Affected versions

• go.opentelemetry.io/otel v1.41.0 – v1.41.x (before 1.42.0)
• go.opentelemetry.io/otel v1.43.0 – v1.43.x (before 1.44.0) ← this repo

Confirmed affected images

• temporalio/server:1.31.1
• temporalio/admin-tools:1.31.1

Suggested fix

Bump go.opentelemetry.io/otel (and sub-modules) to v1.44.0 or later in go.mod / go.sum.

go get go.opentelemetry.io/otel@v1.44.0
go get go.opentelemetry.io/otel/propagation@v1.44.0
go mod tidy