Vulnerability-Lookup

CVE-2026-45292 (GCVE-0-2026-45292)

Vulnerability from cvelistv5 – Published: 2026-05-28 16:37 – Updated: 2026-05-28 17:27

Title

opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

Summary

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-j…	x_refsource_MISC

Impacted products

3 products

Vendor	Product	Version
open-telemetry	opentelemetry-java	Affected: < 1.62.0
io.opentelemetry	opentelemetry-api	Affected: 1.62.0
io.opentelemetry	opentelemetry-extension-trace-propagators	Affected: 1.62.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T17:27:00.066477Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T17:27:14.164Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-java",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.62.0"
            }
          ]
        },
        {
          "product": "opentelemetry-api",
          "vendor": "io.opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "1.62.0"
            }
          ]
        },
        {
          "product": "opentelemetry-extension-trace-propagators",
          "vendor": "io.opentelemetry",
          "versions": [
            {
              "status": "affected",
              "version": "1.62.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T16:37:29.490Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-java/pull/8380",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rcgg-9c38-7xpx",
        "discovery": "UNKNOWN"
      },
      "title": "opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45292",
    "datePublished": "2026-05-28T16:37:29.490Z",
    "dateReserved": "2026-05-11T20:14:43.201Z",
    "dateUpdated": "2026-05-28T17:27:14.164Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45292",
      "date": "2026-06-03",
      "epss": "0.00059",
      "percentile": "0.18671"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45292\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-28T17:16:32.060\",\"lastModified\":\"2026-05-29T15:42:56.873\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"references\":[{\"url\":\"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-java/pull/8380\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45292\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-28T17:27:00.066477Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-28T17:27:08.804Z\"}}], \"cna\": {\"title\": \"opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation\", \"source\": {\"advisory\": \"GHSA-rcgg-9c38-7xpx\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"open-telemetry\", \"product\": \"opentelemetry-java\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.62.0\"}]}, {\"vendor\": \"io.opentelemetry\", \"product\": \"opentelemetry-api\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.62.0\"}]}, {\"vendor\": \"io.opentelemetry\", \"product\": \"opentelemetry-extension-trace-propagators\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.62.0\"}]}], \"references\": [{\"url\": \"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx\", \"name\": \"https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-java/pull/8380\", \"name\": \"https://github.com/open-telemetry/opentelemetry-java/pull/8380\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f\", \"name\": \"https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0\", \"name\": \"https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"CWE-770: Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-28T16:37:29.490Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45292\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-28T17:27:14.164Z\", \"dateReserved\": \"2026-05-11T20:14:43.201Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-28T16:37:29.490Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45292

Vulnerability from fkie_nvd - Published: 2026-05-28 17:16 - Updated: 2026-05-29 15:42

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-java/pull/8380
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request. This vulnerability is fixed in 1.62.0."
    }
  ],
  "id": "CVE-2026-45292",
  "lastModified": "2026-05-29T15:42:56.873",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-28T17:16:32.060",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-RCGG-9C38-7XPX

Vulnerability from github – Published: 2026-05-14 16:36 – Updated: 2026-05-14 16:36

Summary

OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

Details

Overview

A vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage causes unbounded memory allocation and CPU consumption. Because baggage is automatically re-injected into every outgoing request, the effect can fan out to downstream services that never received the original malicious request.

Technical Details

W3CBaggagePropagator did not enforce any limit on the total size or entry count of the baggage header. The parser iterated character-by-character through the entire value regardless of length.
JaegerPropagator and OtTracePropagator had the same gap in their respective baggage extraction paths.
The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; none of these limits were enforced.

Impact

The practical availability impact for most deployments is limited. Every major Java HTTP server enforces its own header size limit (Tomcat, Jetty, Netty, Vert.x, and gRPC-Java all default to 8 KiB), constraining what an external attacker can deliver before the application is reached. The risk is higher when transport-layer limits are absent — e.g., a compromised internal service communicating over a non-HTTP or custom transport.

Remediation

Update to version 1.62.0 or later (#8380). The fix enforces limits consistent with the W3C Baggage specification at the propagator level:

Maximum total baggage size: 8,192 bytes across all baggage header values
Maximum number of entries: 64

Headers that would exceed either limit are dropped at the point the limit is reached; already-extracted valid entries are retained.

Workarounds

Ensure HTTP header size limits are configured at the server or gateway level. Most Java HTTP servers enforce an 8 KiB header limit by default, which mitigates external attack vectors independently of this fix.

References

W3C Baggage Specification §Limits

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.61.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.opentelemetry:opentelemetry-api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.62.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.61.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.opentelemetry:opentelemetry-extension-trace-propagators"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.62.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45292"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T16:36:04Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Overview\n\nA vulnerability affects the baggage propagation implementation in\n`opentelemetry-api` and `opentelemetry-extension-trace-propagators`. Parsing oversized baggage\ncauses unbounded memory allocation and CPU consumption. Because baggage is automatically\nre-injected into every outgoing request, the effect can fan out to downstream services that\nnever received the original malicious request.\n\n## Technical Details\n\n- `W3CBaggagePropagator` did not enforce any limit on the total size or entry count of the\n  `baggage` header. The parser iterated character-by-character through the entire value\n  regardless of length.\n- `JaegerPropagator` and `OtTracePropagator` had the same gap in their respective baggage\n  extraction paths.\n- The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; none of\n  these limits were enforced.\n\n## Impact\n\nThe practical availability impact for most deployments is limited. Every major Java HTTP server\nenforces its own header size limit (Tomcat, Jetty, Netty, Vert.x, and gRPC-Java all default to\n8 KiB), constraining what an external attacker can deliver before the application is reached.\nThe risk is higher when transport-layer limits are absent \u2014 e.g., a compromised internal service\ncommunicating over a non-HTTP or custom transport.\n\n## Remediation\n\nUpdate to version 1.62.0 or later ([#8380](https://github.com/open-telemetry/opentelemetry-java/pull/8380)).\nThe fix enforces limits consistent with the W3C Baggage specification at the propagator level:\n\n- Maximum total baggage size: 8,192 bytes across all `baggage` header values\n- Maximum number of entries: 64\n\nHeaders that would exceed either limit are dropped at the point the limit is reached;\nalready-extracted valid entries are retained.\n\n## Workarounds\n\nEnsure HTTP header size limits are configured at the server or gateway level. Most Java HTTP\nservers enforce an 8 KiB header limit by default, which mitigates external attack vectors\nindependently of this fix.\n\n## References\n\n- [W3C Baggage Specification \u00a7Limits](https://www.w3.org/TR/baggage/#limits)",
  "id": "GHSA-rcgg-9c38-7xpx",
  "modified": "2026-05-14T16:36:04Z",
  "published": "2026-05-14T16:36:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-java/pull/8380"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-45292 (GCVE-0-2026-45292)

FKIE_CVE-2026-45292

GHSA-RCGG-9C38-7XPX

Overview

Technical Details

Impact

Remediation

Workarounds

References

Tags

Sightings

Nomenclature