Vulnerability-Lookup

CVE-2026-59892 (GCVE-0-2026-59892)

Vulnerability from cvelistv5 – Published: 2026-07-08 16:03 – Updated: 2026-07-08 19:41

Title

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Summary

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-08 19:40 UTC

CWE

CWE-248 - Uncaught Exception

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7820 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
open-telemetry	opentelemetry-js	Affected: < 2.9.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-59892",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T19:40:34.423590Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-08T19:41:27.498Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-js",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-248",
              "description": "CWE-248: Uncaught Exception",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-08T16:03:58.439Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-45rx-2jwx-cxfr",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-59892",
    "datePublished": "2026-07-08T16:03:58.439Z",
    "dateReserved": "2026-07-07T16:40:07.983Z",
    "dateUpdated": "2026-07-08T19:41:27.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-59892",
      "date": "2026-11-12",
      "epss": "0.00557",
      "percentile": "0.46949"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "opentelemetry-js",
                "vendor": "open-telemetry",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.9.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0."
          },
          {
            "lang": "es",
            "value": "OpenTelemetry JavaScript es el cliente OpenTelemetry JavaScript. Antes de la versi\u00f3n 2.9.0, @opentelemetry/propagator-jaeger decodifica los valores de los encabezados HTTP entrantes uber-trace-id y uberctx-* con decodeURIComponent() sin manejar errores de decodificaci\u00f3n, permitiendo a un atacante remoto no autenticado enviar un valor codificado por porcentaje malformado que lanza un URIError no capturado y termina un proceso de Node.js que utiliza JaegerPropagator como propagador activo. Este problema se ha solucionado en la versi\u00f3n 2.9.0."
          }
        ],
        "id": "CVE-2026-59892",
        "lastModified": "2026-10-25T17:10:00.197",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-59892",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-08T19:40:34.423590Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-08T17:17:27.190",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-248"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-27T02:37:49+00:00",
      "cve": "CVE-2026-59892",
      "id": "CVE-2026-59892",
      "initial_release_date": "2026-07-08T16:03:58.439000+00:00",
      "product_status:fixed": "2",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59892.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-59892",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-08T19:40:34.423590Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-08T19:40:56.064Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "opentelemetry-js",
              "vendor": "open-telemetry",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.9.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-248",
                  "description": "CWE-248: Uncaught Exception",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-08T16:03:58.439Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
            },
            {
              "name": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88"
            },
            {
              "name": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"
            }
          ],
          "source": {
            "advisory": "GHSA-45rx-2jwx-cxfr",
            "discovery": "UNKNOWN"
          },
          "title": "OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-59892",
        "datePublished": "2026-07-08T16:03:58.439Z",
        "dateReserved": "2026-07-07T16:40:07.983Z",
        "dateUpdated": "2026-07-08T19:41:27.498Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CLEANSTART-2026-SG26208 (CVE-2026-59892)

Vulnerability from cleanstart – Published: 2026-09-18 09:38 – Updated: 2026-10-09 05:37 – Source website

Summary

Security fix for CVE-2026-59892 applied in: n8n 2.28.0-r2, pulumi 3.248.0-r0

Details

CVE-2026-59892 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

Severity

7.5 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-59892	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-59892	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "n8n",
        "purl": "pkg:apk/cleanstart/n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.28.0-r2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "pulumi",
        "purl": "pkg:apk/cleanstart/pulumi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.248.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "CVE-2026-59892 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-SG26208",
  "modified": "2026-10-09T05:37:21Z",
  "published": "2026-09-18T09:38:06.953376Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SG26208.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-59892"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59892"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Security fix for CVE-2026-59892 applied in: n8n 2.28.0-r2, pulumi 3.248.0-r0",
  "upstream": [
    "CVE-2026-59892"
  ]
}

CLEANSTART-2026-TX42489 (GHSA-HRXH-6V49-42GF)

Vulnerability from cleanstart – Published: 2026-09-01 11:17 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in pulumi 3.248.0-r0

Details

Package pulumi version 3.248.0-r0 fixes 30 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-56864, CVE-2026-56865, CVE-2026-56852, CVE-2026-71556...

References

URL

Type

https://github.com/pulumi/pulumi

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "pulumi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.248.0-r0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.248.0-r0"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package pulumi version 3.248.0-r0 fixes 30 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-56864, CVE-2026-56865, CVE-2026-56852, CVE-2026-71556...",
  "id": "CLEANSTART-2026-TX42489",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-09-01T11:17:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/pulumi/pulumi"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in pulumi 3.248.0-r0",
  "upstream": [
    "ghsa-hrxh-6v49-42gf",
    "CVE-2026-56864",
    "CVE-2026-56865",
    "CVE-2026-56852",
    "CVE-2026-71556",
    "CVE-2026-71557",
    "ghsa-259r-337f-4rfw",
    "CVE-2026-5160",
    "CVE-2026-59873",
    "CVE-2026-59871",
    "CVE-2026-59874",
    "CVE-2026-59875",
    "CVE-2026-53655",
    "ghsa-r292-9mhp-454m",
    "CVE-2026-59869",
    "ghsa-5p4m-2wfm-xmqj",
    "CVE-2026-45149",
    "CVE-2026-14257",
    "CVE-2026-69152",
    "CVE-2026-13149",
    "CVE-2026-54285",
    "CVE-2026-59892",
    "CVE-2026-59877",
    "CVE-2026-9496",
    "CVE-2026-9358",
    "CVE-2026-69192",
    "CVE-2026-42338",
    "CVE-2026-48758",
    "CVE-2026-48815",
    "CVE-2026-48816"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

CLEANSTART-2026-YP71540 (CVE-2026-14643)

Vulnerability from cleanstart – Published: 2026-08-13 12:10 – Updated: 2026-09-18 11:59 – Source website

Withdrawn 2026-09-18

Summary

Security fixes in n8n 2.28.0-r2

Details

Package n8n version 2.28.0-r2 fixes 46 vulnerabilities: CVE-2026-14643, CVE-2024-7042, CVE-2025-68665, CVE-2024-7774, CVE-2026-59873...

References

URL

Type

https://n8n.io

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "n8n"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.28.0-r2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.28.0-r2"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package n8n version 2.28.0-r2 fixes 46 vulnerabilities: CVE-2026-14643, CVE-2024-7042, CVE-2025-68665, CVE-2024-7774, CVE-2026-59873...",
  "id": "CLEANSTART-2026-YP71540",
  "modified": "2026-09-18T11:59:01.768079Z",
  "published": "2026-08-13T12:10:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://n8n.io"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in n8n 2.28.0-r2",
  "upstream": [
    "CVE-2026-14643",
    "CVE-2024-7042",
    "CVE-2025-68665",
    "CVE-2024-7774",
    "CVE-2026-59873",
    "CVE-2026-13697",
    "CVE-2026-69198",
    "CVE-2026-27795",
    "CVE-2026-26019",
    "CVE-2026-16728",
    "CVE-2026-16729",
    "CVE-2026-59892",
    "CVE-2026-39244",
    "ghsa-gcfj-64vw-6mp9",
    "CVE-2026-14257",
    "CVE-2026-15157",
    "CVE-2026-69152",
    "CVE-2026-69153",
    "CVE-2026-18446",
    "CVE-2026-71849",
    "CVE-2026-69192",
    "ghsa-5p4m-2wfm-xmqj",
    "CVE-2026-59887",
    "CVE-2026-67213",
    "CVE-2026-67214",
    "CVE-2026-67314",
    "CVE-2026-59877",
    "CVE-2026-59876",
    "CVE-2026-59871",
    "CVE-2026-54272",
    "CVE-2026-59875",
    "CVE-2026-59874",
    "ghsa-frvp-7c67-39w9",
    "ghsa-42h9-826w-cgv3",
    "ghsa-7q8q-rj6j-mhjq",
    "ghsa-f4gw-2p7v-4548",
    "ghsa-hcpx-6fm6-wx23",
    "ghsa-jqh4-m9w3-8hp9",
    "ghsa-mmx7-hfxf-jppx",
    "ghsa-mwf2-3pr3-8698",
    "ghsa-pmv8-rq9r-6j72",
    "CVE-2026-69207",
    "CVE-2026-53606",
    "CVE-2026-71848",
    "CVE-2026-71850",
    "ghsa-r292-9mhp-454m"
  ],
  "withdrawn": "2026-09-18T11:59:01.768079Z"
}

FKIE_CVE-2026-59892

Vulnerability from fkie_nvd - Published: 2026-07-08 17:17 - Updated: 2026-10-25 17:10

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "opentelemetry-js",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0."
    },
    {
      "lang": "es",
      "value": "OpenTelemetry JavaScript es el cliente OpenTelemetry JavaScript. Antes de la versi\u00f3n 2.9.0, @opentelemetry/propagator-jaeger decodifica los valores de los encabezados HTTP entrantes uber-trace-id y uberctx-* con decodeURIComponent() sin manejar errores de decodificaci\u00f3n, permitiendo a un atacante remoto no autenticado enviar un valor codificado por porcentaje malformado que lanza un URIError no capturado y termina un proceso de Node.js que utiliza JaegerPropagator como propagador activo. Este problema se ha solucionado en la versi\u00f3n 2.9.0."
    }
  ],
  "id": "CVE-2026-59892",
  "lastModified": "2026-10-25T17:10:00.197",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59892",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-08T19:40:34.423590Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-08T17:17:27.190",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-248"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-45RX-2JWX-CXFR

Vulnerability from github – Published: 2026-07-21 19:07 – Updated: 2026-07-21 19:07

Summary

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Details

Summary

@opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent() without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare %) in an uber-trace-id or uberctx-* header throws an uncaught URIError, terminating any Node.js process that uses JaegerPropagator as its active propagator.

Impact

Denial of Service: Any unauthenticated remote attacker who can send an HTTP request to a service that has JaegerPropagator registered as the global propagator (e.g. via OTEL_PROPAGATORS=jaeger or propagation.setGlobalPropagator(new JaegerPropagator())) can terminate the process with a single request. Confidentiality and integrity are not affected.

Am I affected?

This issue affects only a specific, opt-in configuration. If you use OpenTelemetry's default propagators (W3C TraceContext and Baggage), you are not affected.

You are affected only if you have registered JaegerPropagator as the active propagator. Check for:

@opentelemetry/propagator-jaeger in your dependency tree, and
OTEL_PROPAGATORS set to jaeger (Jaeger only), or a direct propagation.setGlobalPropagator(new JaegerPropagator()) call in your code.

Note: if JaegerPropagator is combined with other propagators through a CompositePropagator (for example OTEL_PROPAGATORS=jaeger,tracecontext), the process does not terminate - the composite propagator catches the error - but affected requests silently fail to extract context. You should still upgrade.

Patched versions

@opentelemetry/propagator-jaeger 2.9.0

Remediation

Update @opentelemetry/propagator-jaeger to 2.9.0 or later. The propagator now ignores header values it cannot decode instead of throwing.

Interim mitigation (if you cannot update): Trace-context headers should never be accepted unfiltered from untrusted callers. Until you can upgrade, strip or validate the uber-trace-id and uberctx-* headers on inbound requests at your edge - for example with a reverse proxy, API gateway, or load balancer (nginx, Envoy, etc.) - so that only trusted upstream services can set them.

Details

JaegerPropagator.extract() calls decodeURIComponent() on raw header values at two unguarded call sites: the uber-trace-id trace header and each uberctx-* baggage value. decodeURIComponent() throws URIError: URI malformed on invalid percent-encoding. Because the HTTP instrumentation extracts context before its request-handler error wrapper, and a single configured propagator is not wrapped in a CompositePropagator (which would otherwise catch the error), the exception propagates as an uncaughtException and terminates the process.

Proof of concept

Against a service using JaegerPropagator:

curl -H 'uberctx-user: %' http://target/
# or
curl -H 'uber-trace-id: %' http://target/

The Node.js process exits with URIError: URI malformed and subsequent requests are refused.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "@opentelemetry/propagator-jaeger"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-59892"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-248"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T19:07:28Z",
    "nvd_published_at": "2026-07-08T17:17:27Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`@opentelemetry/propagator-jaeger` decodes incoming HTTP header values with `decodeURIComponent()` without handling decode errors. A single request carrying a malformed percent-encoded value (for example a bare `%`) in an `uber-trace-id` or `uberctx-*` header throws an uncaught `URIError`, terminating any Node.js process that uses `JaegerPropagator` as its active propagator.\n\n\n## Impact\n\n**Denial of Service:** Any unauthenticated remote attacker who can send an HTTP request to a service that has `JaegerPropagator` registered as the global propagator (e.g. via `OTEL_PROPAGATORS=jaeger` or `propagation.setGlobalPropagator(new JaegerPropagator())`) can terminate the process with a single request. Confidentiality and integrity are not affected.\n\n## Am I affected?\n\nThis issue affects only a specific, opt-in configuration. If you use OpenTelemetry\u0027s default propagators (W3C TraceContext and Baggage), you are **not** affected.          \n\nYou are affected only if you have registered `JaegerPropagator` as the active propagator. Check for:\n\n- `@opentelemetry/propagator-jaeger` in your dependency tree, **and**\n- `OTEL_PROPAGATORS` set to `jaeger` (Jaeger only), **or** a direct `propagation.setGlobalPropagator(new JaegerPropagator())` call in your code.\n\nNote: if `JaegerPropagator` is combined with other propagators through a `CompositePropagator` (for example `OTEL_PROPAGATORS=jaeger,tracecontext`), the process does not terminate - the composite propagator catches the error - but affected requests silently fail to extract context. You should still upgrade.\n\n\n## Patched versions\n\n- `@opentelemetry/propagator-jaeger` 2.9.0\n\n## Remediation\n\nUpdate `@opentelemetry/propagator-jaeger` to 2.9.0 or later. The propagator now ignores header values it cannot decode instead of throwing.\n\n**Interim mitigation (if you cannot update):** Trace-context headers should never be accepted unfiltered from untrusted callers. Until you can upgrade, strip or validate the `uber-trace-id` and `uberctx-*` headers on inbound requests at your edge - for example with a reverse proxy, API gateway, or load balancer (nginx, Envoy, etc.) - so that only trusted upstream services can set them.\n\n## Details\n\n`JaegerPropagator.extract()` calls `decodeURIComponent()` on raw header values at two unguarded call sites: the `uber-trace-id` trace header and each `uberctx-*` baggage value. `decodeURIComponent()` throws `URIError: URI malformed` on invalid percent-encoding. Because the HTTP instrumentation extracts context before its request-handler error wrapper, and a single configured propagator is not wrapped in a `CompositePropagator` (which would otherwise catch the error), the exception propagates as an `uncaughtException` and terminates the process.\n\n## Proof of concept\n\nAgainst a service using `JaegerPropagator`:\n\n```bash\ncurl -H \u0027uberctx-user: %\u0027 http://target/\n# or\ncurl -H \u0027uber-trace-id: %\u0027 http://target/\n```\n\nThe Node.js process exits with `URIError: URI malformed` and subsequent requests are refused.",
  "id": "GHSA-45rx-2jwx-cxfr",
  "modified": "2026-07-21T19:07:28Z",
  "published": "2026-07-21T19:07:28Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-45rx-2jwx-cxfr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59892"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-js/commit/b1c196d49d54caae59741cca0a9d57d101d7ea88"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-js"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-js/releases/tag/v2.9.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header"
}

RHSA-2026:49642

Vulnerability from csaf_redhat - Published: 2026-08-03 10:03 - Updated: 2026-11-13 00:14

Summary

Red Hat Security Advisory: Red Hat Developer Hub 1.10.3 release.

Severity

Important

Scope

14 vulnerabilities in this advisory, including CVE-2026-59892.

CVE-2026-59892

A flaw was found in the `@opentelemetry/propagator-jaeger` component of OpenTelemetry JavaScript. This vulnerability allows an unauthenticated remote attacker to send specially crafted HTTP header values, specifically `uber-trace-id` and `uberctx-*`. The component improperly decodes these values without handling potential errors, leading to an uncaught `URIError`. Successful exploitation of this flaw can terminate a Node.js process, resulting in a Denial of Service (DoS).

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product Known not affected: 4 products

https://access.redhat.com/errata/RHSA-2026:49642

Open the full advisory

RHSA-2026:52768

Vulnerability from csaf_redhat - Published: 2026-08-10 09:41 - Updated: 2026-11-11 09:02

Summary

Red Hat Security Advisory: Red Hat Developer Hub 1.9.8 release.

Severity

Important

Scope

11 vulnerabilities in this advisory, including CVE-2026-59892.

CVE-2026-59892

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product Known not affected: 2 products

https://access.redhat.com/errata/RHSA-2026:52768

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-59892 (GCVE-0-2026-59892)

CLEANSTART-2026-SG26208 (CVE-2026-59892)

CLEANSTART-2026-TX42489 (GHSA-HRXH-6V49-42GF)

CLEANSTART-2026-YP71540 (CVE-2026-14643)

FKIE_CVE-2026-59892

GHSA-45RX-2JWX-CXFR

Summary

Impact

Am I affected?

Patched versions

Remediation

Details

Proof of concept

RHSA-2026:49642

RHSA-2026:52768

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour