deps: update dependency io.opentelemetry:opentelemetry-api to v1.62.0 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
io.opentelemetry:opentelemetry-api	1.52.0 → 1.62.0

---

OpenTelemetry Java SDK has Unbounded Memory Allocation in W3C Baggage Propagation

CVE-2026-45292 / GHSA-rcgg-9c38-7xpx

More information

Details

Overview

A vulnerability affects the baggage propagation implementation in
opentelemetry-api and opentelemetry-extension-trace-propagators. Parsing oversized baggage
causes unbounded memory allocation and CPU consumption. Because baggage is automatically
re-injected into every outgoing request, the effect can fan out to downstream services that
never received the original malicious request.

Technical Details

• W3CBaggagePropagator did not enforce any limit on the total size or entry count of the
  baggage header. The parser iterated character-by-character through the entire value
  regardless of length.
• JaegerPropagator and OtTracePropagator had the same gap in their respective baggage
  extraction paths.
• The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; none of
  these limits were enforced.

Impact

The practical availability impact for most deployments is limited. Every major Java HTTP server
enforces its own header size limit (Tomcat, Jetty, Netty, Vert.x, and gRPC-Java all default to
8 KiB), constraining what an external attacker can deliver before the application is reached.
The risk is higher when transport-layer limits are absent — e.g., a compromised internal service
communicating over a non-HTTP or custom transport.

Remediation

Update to version 1.62.0 or later (#​8380).
The fix enforces limits consistent with the W3C Baggage specification at the propagator level:

• Maximum total baggage size: 8,192 bytes across all baggage header values
• Maximum number of entries: 64

Headers that would exceed either limit are dropped at the point the limit is reached;
already-extracted valid entries are retained.

Workarounds

Ensure HTTP header size limits are configured at the server or gateway level. Most Java HTTP
servers enforce an 8 KiB header limit by default, which mitigates external attack vectors
independently of this fix.

References

• W3C Baggage Specification §Limits

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-java/security/advisories/GHSA-rcgg-9c38-7xpx
• https://github.com/open-telemetry/opentelemetry-java/pull/8380
• https://github.com/open-telemetry/opentelemetry-java/commit/03837d3c1763bc35464aea1078671e2ef2336a5f
• https://github.com/open-telemetry/opentelemetry-java/releases/tag/v1.62.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-45292
• https://github.com/advisories/GHSA-rcgg-9c38-7xpx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-java (io.opentelemetry:opentelemetry-api)

v1.62.0

Compare Source

API

Context

• Fix GHSA-rcgg-9c38-7xpx: Apply limits to baggage entries for W3CBaggagePropagator, OtTracePropagator, JaegerPropagator
  (#​8378)

SDK

Traces

• Avoid parentContext allocation on span start for the common case
  (#​8332)

Metrics

• Add setMaxExportBatchSize to PeriodicMetricReaderBuilder
  (#​8296)
• Fix PeriodicMetricReader shutdown race that could drop the final flush
  (#​8299)

Exporters

• BREAKING Prometheus: Change default server host from 0.0.0.0 to localhost
  (#​8298)
• BREAKING Prometheus: Stop converting unit "1" to "ratio"
  (#​8252)
• OTLP: Fix null input handling in StringEncoder
  (#​8312)
• OTLP: Align proto field types and wire tag names in marshalers
  (#​8293)
• OTLP: Fix MarshalerUtil sizeRepeatedString calculation
  (#​8284)
• OTLP: Bound JdkHttpSender thread pool size to prevent unbounded thread creation
  (#​8276)
• OTLP Profiles: Split profiles data model into separate sdk-profiles and JFR shim modules
  (#​8207)
• OTLP Profiles: Publish alpha release of opentelemetry-sdk-profiles and
  opentelemetry-exporter-otlp-profiles
  (#​8351)

Extensions

• BREAKING Declarative config: Extract to new opentelemetry-sdk-extension-declarative-config
  artifact with new package io.opentelemetry.sdk.autoconfigure.declarativeconfig
  (#​8265)
• Autoconfigure: Add file size validation in OtlpConfigUtil to avoid unsafe cast to int
  (#​8287)
• Declarative config: Fix collection fields to not be initialized to empty by default
  (#​8356)
• Incubator: Add EventToSpanEventBridge to bridge log-based events to span events
  (#​8372)

Testing

• Add @Nullable to equalTo value argument in OpenTelemetryAssertions
  (#​8301)
• Add hasValueSatisfying to LongPointAssert and DoublePointAssert for fuzzy value matching
  (#​8328)
• Add containsPointsSatisfying to metric data asserts for "each given assertion must be
  satisfied by at least one point, extras allowed" checks on sum, gauge, histogram, exponential
  histogram, and summary data
  (#​8329)

Project tooling

• Add initial OSGi support
  (#​7964)
• Promote ApiUsageLogger to opentelemetry-common public API
  (#​8318)
• Establish exception logging guidelines and fix inconsistent patterns across exporters and SDK
  (#​8231)
• Add *.impl.* package naming convention for internal code with japicmp compatibility
  (#​8325)
• Add Sonatype dependency audit to build
  (#​8365)

v1.61.0

Compare Source

API

• Stabilize isEnabled() on Tracer, Logger, and metric instruments
  (#​8200)

Incubating

• BREAKING Update EnvironmentGetter and EnvironmentSetter key normalization to reflect spec
  changes
  (#​8233)

SDK

Traces

• Retain propagated context when generating random trace IDs
  (#​8263)
• Add rate-limited warning log when BatchSpanProcessor drops spans
  (#​8167)

Metrics

• Track series start time per aggregator rather than at SdkMeterProvider creation time
  (#​8180)
• Capture context class loader during async callback registration
  (#​8091)
• Make include/exclude work correctly with empty (but non-null) lists
  (#​8185)

Logs

• Fix condition for recording successful log processing metrics
  (#​8226)

Exporters

• OTLP: add configurable bounds to response body reading
  (#​8224, #​8277)
• OTLP: only throw invalid response exception when gRPC response size < 5 bytes
  (#​8194)
• OTLP: remove duplicate FINEST-level error logging in gRPC exporter
  (#​8216)
• OTLP Profiles: clean up profile signal exporters for consistency
  (#​8172)

Extensions

• BREAKING Autoconfigure: remove deprecated ComponentLoader class (use
  io.opentelemetry.common.ComponentLoader instead)
  (#​8243)
• Declarative config: fix DeclarativeConfigProperties javadoc to not throw exceptions
  (#​8079)
• Declarative config: resource attribute filtering should include attributes by default
  (#​8177)
• Declarative config: enforce IncludedExcludeModel .included and .excluded are not empty
  (#​8266)
• Autoconfigure: restructure SDK incubator to not depend on autoconfigure internals
  (#​8242)

Project tooling

• Disable Gradle build cache on releases to mitigate supply chain risk
  (#​8254)

v1.60.1

Compare Source

SDK

Extensions

• Autoconfigure: fix warning always emitted
  (#​8157)

v1.60.0

Compare Source

API

• Support W3C trace context random flag
  (#​8012)
• Clarify that SpanBuilder.setAttribute allows null values
  (#​8072)

Incubating

• Implement environment variable context propagation carriers
  (#​8074)
• Deprecate ExtendedAttributes, ExtendedAttributeKey, ExtendedAttributeType,
  ExtendedAttributesBuilder
  (#​8060)
• Deprecate peerServiceMapping accessor from InstrumentationConfigUtil
  (#​8088)

SDK

Traces

• Disable warning when using TraceIdRatioBasedSampler as root sampler
  (#​8065)
• User-supplied attributes take precedence over exception-derived attributes
  (#​7993)
• Exclude META-INF/maven from traces SDK shaded dependencies
  (#​8096)
• Fix inverted condition in LegacySpanProcessorInstrumentation#finishSpans
  (#​8145)

Metrics

• Split out cumulative vs. delta storage
  (#​8015)
• Add metrics for PeriodicMetricReader
  (#​8038)
• Allow configuring min/max in histograms
  (#​8095)
• Remove deprecated otel.experimental.metrics.cardinality.limit property
  (#​8124)
• BREAKING bug fix: GlobUtil and IncludePatternMatching, used in views and declarative
  config matching, previously were inconsistent in case sensitivity. If a glob char (* or ?) was
  present, it was evaluated with case sensitivity. If no glob chars were present, it was evaluated
  with case insensitivity. Now, all are consistently evaluated with case sensitivity.
  (#​8152)

Logs

• Stabilize LogRecordBuilder.setException
  (#​8089)
• Clarify setTimestamp javadoc for event timestamp behavior
  (#​8104)

Exporters

• OTLP: Fix marshaling for empty string attributes
  (#​8014)
• Prometheus: Update Prometheus client to 1.5.0
  (#​8080)
• OTLP: Serialize exponential histogram sum as optional double
  (#​8107)
• OTLP: Use KeyManagerFactory.getDefaultAlgorithm() in TlsUtil.keyManager()
  (#​8122)
• OTLP: Ensure proto serializer idCache is cleared when exception is thrown
  (#​8147)

Extensions

• Autoconfigure: Decode plus sign in resource attributes
  (#​8059)
• Declarative config: update to 1.0 schema
  (#​8123)
• Declarative config: add support for setting schema URL
  (#​8028)
• Declarative config: add version mismatch warning
  (#​8069)
• Declarative config: cache component providers in DeclarativeConfigContext
  (#​8070)
• Declarative config: add system property substitution
  (#​8073)
• Declarative config: add exporter customizers
  (#​8081)
• Declarative config: add support for setting internal telemetry version
  (#​8045)
• Deprecate View File Configuration mechanism
  (#​8133)
• Autoconfigure: add property to allow autoconfiguration of SDK telemetry version
  (#​8037)
• Jaeger remote sampler: refactor to leverage senders
  (#​8046)
• Declarative config: document ObjectMapper config
  (#​8075)
• Declarative config: Remove unchecked warning
  (#​8090)

Project tooling

• Add architecture test to detect usage of shared internal code
  (#​6978)
• Replace Xlint deprecation check with custom error-prone check
  (#​8061)
• Enable error-prone's UnnecessarilyFullyQualified check
  (#​8078)
• Small refactoring to make safety clearer
  (#​8083)
• Rework span record benchmark and publish results
  (#​8031)
• Add LogRecordBenchmark
  (#​8106,
  #​8117)

v1.59.0

Compare Source

API

• Stabilize complex attributes
  (#​7973)
• Limit init valid hex array to range that can be true
  (#​7809)

Extensions

• Trace propagators: Deprecate OtTracePropagator
  (#​8020)
• Trace propagators: Deprecate JaegerPropagator
  (#​8019)

SDK

• Move io.opentelemetry.sdk.internal to io.opentelemetry.sdk.common.internal
  (#​8003)
• Always return ExtendedOpenTelemetry when incubator is available
  (#​7991)

Traces

• Fix memory leak in SdkSpan#spanEndingThread
  (#​7984)

Metrics

• Rework and publish metric benchmarks
  (#​8000)
• Update LongLastValueAggregator algo to avoid allocations
  (#​8017)

Testing

• Fix OTel JUnit5 Extension cleanup when using Nested test classes
  (#​7999)
• Add assertion support for Span hasException(null)
  (#​8033)

Exporters

• DEPRECATION: opentelemetry-exporter-zipkin is now deprecated with the
  last release planned for 1.65.0 (August 2026)
  (#​7974)
• Refactor http, grpc senders and promote to public API
  (#​7782)

Extensions

• Jaeger remote sampler: Remove unused code
  (#​7970)
• Incubator: Add AlwaysRecordSampler
  (#​7877)

Project tooling

• Align generate release contributors
  (#​8023)

v1.58.0

Compare Source

API

Incubator

• Delete GlobalConfigProvider in favor of access via ExtendedOpenTelemetry
  (#​7914)
• Add DeclarativeConfigProperties#get method
  (#​7923)
• Update ConfigProvider#getInstrumentationConfig response to be non-null
  (#​7954)
• Add declarative config utility methods for common operations
  (#​7927)

SDK

Traces

• Implement SDK metrics for trace
  (#​7895,
  #​7930)
• Emit warning when TraceIdRatioBasedSampler is used as child sampler
  (#​7937)

Logs

• Implement SDK metrics for logs
  (#​7931)

Exporters

• Prom exporter update
  (#​7934)

Extensions

• Declarative config: update to opentelemetry-configuration 1.0.0-rc.3
  (#​7861)
• Declarative config: update jaeger remote sampler to require endpoint, initial_sampler
  (#​7943)
• Declarative config: add support for view unit
  (#​7942)
• Declarative config: add support for new logger config minimum_severity and trace_based properties
  (#​7940)
• Declarative config: add support for composable parent threshold sampler
  (#​7941)
• Declarative config: improve pattern for validating and loading SDK extension plugins
  (#​7947)

Project tooling

• Use develocity build cache in PRs and local builds
  (#​7906)
• Configure japicmp classpath to avoid false positives
  (#​7945)

v1.57.0

Compare Source

API

• Add GlobalOpenTelemetry#getOrNoop, #isSet. Update #get to always returns obfuscated instance
  (#​7819)

Incubating

• Logs: Complex attributes incubating implementation
  (#​7814)

SDK

Logs

• Add minimum severity and trace-based logger configuration (incubating API)
  (#​7529)

Exporters

• OTLP: VarHandle string encoder
  (#​7701)
• OTLP: Fix OkHttpGrpcSender to properly await executor shutdown
  (#​7840)
• OTLP: avoid auto-config warning
  (#​7881)
• OTLP: update error message for missing GrpcSenderProvider dependency
  (#​7884)

Extensions

• Declarative config: add runtime hints for graal VM
  (#​7866)
• Declarative config: add missing warning about discarded value
  (#​7821)

Project tooling

• Update macos version to latest and switch to corretto for testing
  (#​7841)
• Sync Java worflows: Allow re-running prepare release branch workflow
  (#​7845)
• Simplify and standardize renovate custom managers across Java repos
  (#​7846)
• Remove misspell workflow
  (#​7852)
• Fix link checks on main
  (#​7867)
• Add zeitlinger as approver
  (#​7868)
• Move snapshot publishing to daily build
  (#​7886)

v1.56.0

Compare Source

API

Incubator

• Support ExtendedOpenTelemetry in GlobalOpenTelemetry
  (#​7799)

SDK

• Changes to MeterConfig, LoggerConfig, TracerConfig are guaranteed to be eventually visible
  (#​7706)

Metrics

• Stabilize ExemplarFilter
  (#​7768)
• Type specific exemplar reservoirs
  (#​7758)

Extensions

• SDK incubator: Add incubator ComposableRuleBasedSampler
  (#​7787)
• SDK incubator: Add incubator ComposableAnnotatingSampler
  (#​7804)
• SDK incubator: Rename ComposableTraceIdRatioBased to ComposableProbability
  (#​7786)
• Declarative config: BREAKING Remove component provider generic type
  (#​7606)
• Declarative config: Add declarative config support for ExemplarFilter
  (#​7769)
• Declarative config: Fix a few declarative configuration bugs
  (#​7807)

Project tooling

• Move to oracle bare metal benchmark runner
  (#​7740)
• Enable Develocity build scans
  (#​7776)
• Document GPG signing key
  (#​7783)
• Update build to use java 21
  (#​7784)
• Sync repository-settings.md documentation
  (#​7791)
• Fix gradle deprecation warning
  (#​7780)
• Small alignments of workflows across the 6 Java repos
  (#​7806)
• Implement min java version gradle tooling from instrumentation repo
  (#​7801)

v1.55.0

Compare Source

API

Common

• Improve GraalVM native image compatibility
  (#​7160)

Traces

• Fix TraceState key validation limits to match W3C specification
  (#​7575)

Incubator

• Add ExtendedOpenTelemetry API
  (#​7496)
• Add incubator implementation of composite sampling specification
  (#​7626)

SDK

Traces

• Proactively avoid Unsafe on Java 23+ to avoid triggering JVM warning message
  (#​7691)

Metrics

• Add setMeterConfigurator() support to MeterProvider (incubating API)
  (#​7346)

Exporters

• OTLP: Configure metric exporter to use SDK's MeterProvider for internal metrics
  (#​7541)
• OTLP: Suppress logging of InterruptedException from managed OkHttp threads
  (#​7565)
• OTLP: Update dependency from okhttp-jvm back to okhttp for Gradle users,
  preserving okhttp-jvm for Maven users
  (#​7681)
• Prometheus: Remove separate otel_scope_info metric and always add scope labels to data points
  (#​7398)
• Prometheus: Update exporter dependencies to use protobuf-free formats
  (#​7664)

Profiling

• Update profiles exporter to support proto v1.8.0-alpha changes
  (#​7638)
• Add abstractions to assist with dictionary table assembly
  (#​7717)
• Add abstractions to assist with sample composition
  (#​7727)

Extensions

• Autoconfigure: Improve exception logging when running in Maven
  (#​7336)
• Declarative configuration: Return Resource
  (#​7639)
• Declarative configuration: Invoke auto-configure listeners
  (#​7654)
• Declarative configuration: Add logging when incompatible types are found
  (#​7693)

Shims

OpenTracing Shim

• Improve log levels in error scenarios
  (#​6832)

Project tooling

• Respect testJavaVersion property when running JMH benchmarks
  (#​7697)

v1.54.1

Compare Source

SDK

Exporters

• Prometheus: Fix regression in protobuf format export
  (#​7664)

v1.54.0

Compare Source

API

Baggage

• Fix guard against ArrayIndexOutOfBoundsException in BaggageCodec
  (#​7239)

SDK

Metrics

• Fix MetricData.getDoubleSumData() ClassCastException with custom implementations
  (#​7597)

Exporters

• Fix HttpExporterBuilder.copy() and GrpcExporterBuilder.copy() to preserve component loader
  (#​7596)

Extensions

• Autoconfigure: Remove support for old EnvironmentResourceProvider package name
  (#​7622)
• Declarative config: Add DeclarativeConfigurationProvider SPI
  (#​7472)
• Declarative config: Pass meter provider to avoid using the global OpenTelemetry instance
  (#​7475)

Project tooling

• Update to Gradle v9
  (#​7590)

v1.53.0

Compare Source

SDK

• File based config will log the wrong file format, when applicable.
  (#​7498)

Exporters

• Change okhttp dependency to okhttp-jvm, which fixes missing class failures in
  transitive dependencies.
  (#​7517)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.