chore(deps): update rust crate opentelemetry_sdk to 0.32 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
opentelemetry_sdk (source)	dependencies	minor	0.31 → 0.32

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

CVE-2026-48504 / GHSA-w9wp-h8wv-79jx

More information

Details

Summary

BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce the W3C Baggage size limits before parsing an inbound baggage header. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits.

The SDK now applies limits aligned with the W3C Baggage limits:

• 64 list-members
• 8192 bytes total

Impact

Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits.

The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution.

Patches

Upgrade opentelemetry_sdk to version 0.32.1 or later.

Version 0.32.1 rejects baggage header values larger than 8192 bytes and limits extraction to the first 64 list-members.

Workarounds

If upgrading immediately is not possible, reject or limit inbound baggage headers larger than 8192 bytes before invoking OpenTelemetry propagation extraction. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.

Resources

• W3C Baggage limits: https://www.w3.org/TR/baggage/#limits
• Related OpenTelemetry Java advisory: GHSA-rcgg-9c38-7xpx
• Related OpenTelemetry Go advisory: GHSA-mh2q-q3fh-2475
• CVE-2026-48504

Credit

tonghuaroot

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx
• https://github.com/advisories/GHSA-w9wp-h8wv-79jx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-rust (opentelemetry_sdk)

v0.32.1

Released 2026-May-23

• BaggagePropagator now enforces the W3C Baggage maximum header length
  (8192 bytes) and maximum list-member count (64) when extracting an inbound
  baggage header. Headers exceeding 8192 bytes are dropped at the
  propagator boundary; headers with more than 64 list members are
  truncated to the first 64 entries. The change keeps the propagator from
  parsing attacker-controlled input beyond the W3C limits instead of doing
  per-entry parse, decode, and allocation work only to discard the excess
  on Baggage insert. See https://www.w3.org/TR/baggage/#limits.
• Reverted the SimpleSpanProcessor telemetry suppression added in 0.32.0
  (see #​3494), which caused a RefCell already borrowed panic when a span
  was started and dropped inside a get_active_span (or Context::map_current)
  closure. Tracked in #​3510. A proper fix for the underlying
  Context::map_current re-entrancy will be investigated separately, after
  which the suppression can be safely re-applied.
• View-provided metric stream name (set via Stream::builder().with_name(...))
  is no longer validated against the instrument name syntax, per
  spec clarification.
  unit and other stream parameters continue to be validated.

v0.32.0

Compare Source

Released 2026-May-08

• SimpleSpanProcessor now suppresses telemetry during export, preventing
  telemetry-induced-telemetry feedback loops. This aligns with the existing
  behavior in BatchSpanProcessor and SimpleLogProcessor.
• Removed SimpleConcurrentLogProcessor and the experimental_logs_concurrent_log_processor
  feature flag. The use cases it was designed for (ETW/user_events exporters) are
  better served by modeling those exporters as processors directly.
• Added Counter::bind() and Histogram::bind() SDK implementations that
  return pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>).
  Bound instruments resolve the attribute-to-aggregator mapping once at bind time
  and cache the result, eliminating per-call HashMap lookups. View attribute
  filtering is applied at bind time so the hot path stays free of per-call
  attribute processing. Bound and unbound recordings with the same (post-view)
  attribute set always aggregate into the same data point, including the empty
  attribute set. Bound entries are never evicted during delta collection while
  a handle exists — idle cycles produce no export but the tracker persists. If
  bind() is called at the cardinality limit, the handle binds directly to
  the overflow tracker — its writes stay on the same direct (no-lookup) hot
  path and consistently land in the otel.metric.overflow=true bucket for
  the lifetime of the handle. To recover a bound handle after delta collection
  frees space, drop the existing handle and call bind() again. Gated behind
  the experimental_metrics_bound_instruments feature flag. Benchmarks show
  ~28x speedup for counter operations and ~9x for histograms.
• Delta metrics collection now uses in-place eviction instead of draining the
  HashMap on every collect cycle. Stale attribute sets that received no measurements
  since the last collection are evicted. Note: recovery from cardinality overflow
  now requires 2 collect cycles — the first marks entries as stale, the second
  evicts them.
• Breaking The SDK testing feature is now runtime agnostic. #​3407
  • TokioSpanExporter and new_tokio_test_exporter have been renamed to TestSpanExporter and new_test_exporter.
  • The following transitive dependencies and features have been removed: tokio/rt, tokio/time, tokio/macros, tokio/rt-multi-thread, tokio-stream, experimental_async_runtime
• Store InstrumentationScope in Arc internally in SdkTracer, making tracer clones cheaper (Arc refcount increment instead of deep copy).
• Add 32-bit platform support by using portable-atomic for AtomicI64 and AtomicU64 in the metrics module. This enables compilation on 32-bit ARM targets (e.g., armv5te-unknown-linux-gnueabi, armv7-unknown-linux-gnueabihf).
• Aggregation enum and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.
• Fix service.name Resource attribute fallback to follow OpenTelemetry
  specification by using unknown_service:<process.executable.name> format when
  service name is not explicitly configured. Previously, it only used
  unknown_service.
• Fix SpanExporter::shutdown() default timeout from 5 nanoseconds to 5 seconds.
• Breaking SpanExporter trait methods shutdown, shutdown_with_timeout, and force_flush now take &self instead of &mut self for consistency with LogExporter and PushMetricExporter. Implementers using interior mutability (e.g., Mutex, AtomicBool) require no changes.
• Added Resource::get_ref(&self, key: &Key) -> Option<&Value> to allow retrieving a reference to a resource value without cloning.
• Breaking Removed the following public hidden methods from the SdkTracer #​3227:
  • id_generator, should_sample
• Breaking Moved the following SDK sampling types from opentelemetry::trace to opentelemetry_sdk::trace #​3277:
  • SamplingDecision, SamplingResult
  • These types are SDK implementation details and should be imported from opentelemetry_sdk::trace instead.
• StreamBuilder::build() now rejects usize::MAX as a cardinality limit
  with a validation error. #​3506
• Fix Histogram boundaries being ignored in the presence of views #​3312
• TracerProviderBuilder::with_sampler allows to pass boxed instance of ShouldSample [#​3313][3313]
• Fix ObservableCounter and ObservableUpDownCounter now correctly report only data points from the current measurement cycle, removing stale attribute combinations that are no longer observed. #​3248
• Fix panic when SpanProcessor::on_end calls Context::current() (#​3262).
  • Updated SpanProcessor::on_end documentation to clarify that Context::current() returns the parent context, not the span's context
• Fix traceparent headers with unknown flags (e.g. W3C random-trace-id flag 0x02) being incorrectly rejected. Unknown flags are now accepted and zeroed out as required by the W3C trace-context spec. #​3435
• Breaking InMemoryExporterError has been removed and replaced by OTelSdkError, and a new JaegerRemoteSamplerBuildError introduced to replace last uses of TraceError. #​3458
• "spec_unstable_logs_enabled" feature flag is removed. The capability (and the
  backing specification) is now stable and is enabled by default. #​3278

---

Configuration

📅 Schedule: (in timezone America/Havana)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am on the first day of the month"

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​tokio@​1.52.2 ⏵ 1.53.1
	cargo/​surrealdb@​3.0.5 ⏵ 3.2.3	-12	+50
	cargo/​assert_cmd@​2.2.1 ⏵ 2.2.2
	cargo/​thiserror@​2.0.19
	cargo/​anyhow@​1.0.104
	cargo/​serde@​1.0.229
	cargo/​rustls@​0.23.40 ⏵ 0.23.42
	cargo/​serde_json@​1.0.151
	cargo/​webpki-roots@​1.0.9
	cargo/​async-trait@​0.1.91
	cargo/​bytes@​1.12.1
	cargo/​chrono@​0.4.45
	cargo/​clap@​4.6.4
	cargo/​futures-util@​0.3.33
	cargo/​glob@​0.3.4
	cargo/​http@​1.4.2
	cargo/​ignore@​0.4.31
	cargo/​log@​0.4.33
	cargo/​opentelemetry_sdk@​0.32.1
	cargo/​regex@​1.13.1
	cargo/​tokio-util@​0.7.19
	cargo/​uuid@​1.24.0
	cargo/​zeroize@​1.9.0
	cargo/​ratatui@​0.30.2
	cargo/​console@​0.16.3 ⏵ 0.16.4	+1
	cargo/​futures@​0.3.32 ⏵ 0.3.33
	cargo/​landlock@​0.4.4 ⏵ 0.4.6
	cargo/​lettre@​0.11.21 ⏵ 0.11.22
	cargo/​nusb@​0.2.3 ⏵ 0.2.5
	cargo/​prost@​0.14.3 ⏵ 0.14.4
	cargo/​rand@​0.10.1 ⏵ 0.10.2
	cargo/​rcgen@​0.14.7 ⏵ 0.14.8
	cargo/​rustls-pki-types@​1.14.1 ⏵ 1.15.1
See 6 more rows in the dashboard

View full report

[cloudflare-workers-and-pages]

Deploying corvus with    Cloudflare Pages

Latest commit:	675dd13
Status:	✅  Deploy successful!
Preview URL:	https://ced2440a.corvus-42x.pages.dev
Branch Preview URL:	https://renovate-crate-opentelemetry.corvus-42x.pages.dev

View logs

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: cargo tokio is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: clients/agent-runtime/Cargo.lock → cargo/tokio@1.53.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/tokio@1.53.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: cargo zerocopy is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: ? → cargo/reqwest@0.12.28 → cargo/probe-rs@0.31.0 → cargo/criterion@0.8.2 → cargo/tokio-tungstenite@0.29.0 → cargo/opentelemetry-otlp@0.31.1 → cargo/cron@0.16.0 → cargo/opentelemetry_sdk@0.32.1 → cargo/surrealdb@3.2.3 → cargo/pdf-extract@0.10.0 → cargo/zerocopy@0.8.55 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.55. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.