deps: Update Rust crate opentelemetry_sdk to v0.32.1 [SECURITY]

[oplabs-renovate]

This PR contains the following updates:

Package	Type	Update	Change
opentelemetry_sdk (source)	dependencies	minor	0.28.0 → 0.32.0
opentelemetry_sdk (source)	workspace.dependencies	minor	0.31 → 0.32

---

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

CVE-2026-48504 / GHSA-w9wp-h8wv-79jx

More information

Details

Summary

BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce the W3C Baggage size limits before parsing an inbound baggage header. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits.

The SDK now applies limits aligned with the W3C Baggage limits:

• 64 list-members
• 8192 bytes total

Impact

Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits.

The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution.

Patches

Upgrade opentelemetry_sdk to version 0.32.1 or later.

Version 0.32.1 rejects baggage header values larger than 8192 bytes and limits extraction to the first 64 list-members.

Workarounds

If upgrading immediately is not possible, reject or limit inbound baggage headers larger than 8192 bytes before invoking OpenTelemetry propagation extraction. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.

Resources

• W3C Baggage limits: https://www.w3.org/TR/baggage/#limits
• Related OpenTelemetry Java advisory: GHSA-rcgg-9c38-7xpx
• Related OpenTelemetry Go advisory: GHSA-mh2q-q3fh-2475
• CVE-2026-48504

Credit

tonghuaroot

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx
• https://github.com/advisories/GHSA-w9wp-h8wv-79jx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation

CVE-2026-48504 / GHSA-w9wp-h8wv-79jx

More information

Details

Summary

BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce the W3C Baggage size limits before parsing an inbound baggage header. A large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries that would later be discarded by the SDK's baggage storage limits.

The SDK now applies limits aligned with the W3C Baggage limits:

• 64 list-members
• 8192 bytes total

Impact

Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This can contribute to denial-of-service risk, especially when application or transport-level header limits are absent or configured above the W3C Baggage limits.

The impact is limited to availability. This issue does not expose telemetry data, modify telemetry data, or allow code execution.

Patches

Upgrade opentelemetry_sdk to version 0.32.1 or later.

Version 0.32.1 rejects baggage header values larger than 8192 bytes and limits extraction to the first 64 list-members.

Workarounds

If upgrading immediately is not possible, reject or limit inbound baggage headers larger than 8192 bytes before invoking OpenTelemetry propagation extraction. This can be enforced at a proxy, gateway, middleware layer, or custom carrier boundary.

Resources

• W3C Baggage limits: https://www.w3.org/TR/baggage/#limits
• Related OpenTelemetry Java advisory: GHSA-rcgg-9c38-7xpx
• Related OpenTelemetry Go advisory: GHSA-mh2q-q3fh-2475
• CVE-2026-48504

Credit

tonghuaroot

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/open-telemetry/opentelemetry-rust/security/advisories/GHSA-w9wp-h8wv-79jx
• https://github.com/open-telemetry/opentelemetry-rust

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-rust (opentelemetry_sdk)

v0.32.1

Released 2026-May-23

• BaggagePropagator now enforces the W3C Baggage maximum header length
  (8192 bytes) and maximum list-member count (64) when extracting an inbound
  baggage header. Headers exceeding 8192 bytes are dropped at the
  propagator boundary; headers with more than 64 list members are
  truncated to the first 64 entries. The change keeps the propagator from
  parsing attacker-controlled input beyond the W3C limits instead of doing
  per-entry parse, decode, and allocation work only to discard the excess
  on Baggage insert. See https://www.w3.org/TR/baggage/#limits.
• Reverted the SimpleSpanProcessor telemetry suppression added in 0.32.0
  (see #​3494), which caused a RefCell already borrowed panic when a span
  was started and dropped inside a get_active_span (or Context::map_current)
  closure. Tracked in #​3510. A proper fix for the underlying
  Context::map_current re-entrancy will be investigated separately, after
  which the suppression can be safely re-applied.
• View-provided metric stream name (set via Stream::builder().with_name(...))
  is no longer validated against the instrument name syntax, per
  spec clarification.
  unit and other stream parameters continue to be validated.

v0.32.0

Compare Source

Released 2026-May-08

• SimpleSpanProcessor now suppresses telemetry during export, preventing
  telemetry-induced-telemetry feedback loops. This aligns with the existing
  behavior in BatchSpanProcessor and SimpleLogProcessor.
• Removed SimpleConcurrentLogProcessor and the experimental_logs_concurrent_log_processor
  feature flag. The use cases it was designed for (ETW/user_events exporters) are
  better served by modeling those exporters as processors directly.
• Added Counter::bind() and Histogram::bind() SDK implementations that
  return pre-bound measurement handles (BoundCounter<T>, BoundHistogram<T>).
  Bound instruments resolve the attribute-to-aggregator mapping once at bind time
  and cache the result, eliminating per-call HashMap lookups. View attribute
  filtering is applied at bind time so the hot path stays free of per-call
  attribute processing. Bound and unbound recordings with the same (post-view)
  attribute set always aggregate into the same data point, including the empty
  attribute set. Bound entries are never evicted during delta collection while
  a handle exists — idle cycles produce no export but the tracker persists. If
  bind() is called at the cardinality limit, the handle binds directly to
  the overflow tracker — its writes stay on the same direct (no-lookup) hot
  path and consistently land in the otel.metric.overflow=true bucket for
  the lifetime of the handle. To recover a bound handle after delta collection
  frees space, drop the existing handle and call bind() again. Gated behind
  the experimental_metrics_bound_instruments feature flag. Benchmarks show
  ~28x speedup for counter operations and ~9x for histograms.
• Delta metrics collection now uses in-place eviction instead of draining the
  HashMap on every collect cycle. Stale attribute sets that received no measurements
  since the last collection are evicted. Note: recovery from cardinality overflow
  now requires 2 collect cycles — the first marks entries as stale, the second
  evicts them.
• Breaking The SDK testing feature is now runtime agnostic. #​3407
  • TokioSpanExporter and new_tokio_test_exporter have been renamed to TestSpanExporter and new_test_exporter.
  • The following transitive dependencies and features have been removed: tokio/rt, tokio/time, tokio/macros, tokio/rt-multi-thread, tokio-stream, experimental_async_runtime
• Store InstrumentationScope in Arc internally in SdkTracer, making tracer clones cheaper (Arc refcount increment instead of deep copy).
• Add 32-bit platform support by using portable-atomic for AtomicI64 and AtomicU64 in the metrics module. This enables compilation on 32-bit ARM targets (e.g., armv5te-unknown-linux-gnueabi, armv7-unknown-linux-gnueabihf).
• Aggregation enum and StreamBuilder::with_aggregation() are now stable and no longer require the spec_unstable_metrics_views feature flag.
• Fix service.name Resource attribute fallback to follow OpenTelemetry
  specification by using unknown_service:<process.executable.name> format when
  service name is not explicitly configured. Previously, it only used
  unknown_service.
• Fix SpanExporter::shutdown() default timeout from 5 nanoseconds to 5 seconds.
• Breaking SpanExporter trait methods shutdown, shutdown_with_timeout, and force_flush now take &self instead of &mut self for consistency with LogExporter and PushMetricExporter. Implementers using interior mutability (e.g., Mutex, AtomicBool) require no changes.
• Added Resource::get_ref(&self, key: &Key) -> Option<&Value> to allow retrieving a reference to a resource value without cloning.
• Breaking Removed the following public hidden methods from the SdkTracer #​3227:
  • id_generator, should_sample
• Breaking Moved the following SDK sampling types from opentelemetry::trace to opentelemetry_sdk::trace #​3277:
  • SamplingDecision, SamplingResult
  • These types are SDK implementation details and should be imported from opentelemetry_sdk::trace instead.
• StreamBuilder::build() now rejects usize::MAX as a cardinality limit
  with a validation error. #​3506
• Fix Histogram boundaries being ignored in the presence of views #​3312
• TracerProviderBuilder::with_sampler allows to pass boxed instance of ShouldSample [#​3313][3313]
• Fix ObservableCounter and ObservableUpDownCounter now correctly report only data points from the current measurement cycle, removing stale attribute combinations that are no longer observed. #​3248
• Fix panic when SpanProcessor::on_end calls Context::current() (#​3262).
  • Updated SpanProcessor::on_end documentation to clarify that Context::current() returns the parent context, not the span's context
• Fix traceparent headers with unknown flags (e.g. W3C random-trace-id flag 0x02) being incorrectly rejected. Unknown flags are now accepted and zeroed out as required by the W3C trace-context spec. #​3435
• Breaking InMemoryExporterError has been removed and replaced by OTelSdkError, and a new JaegerRemoteSamplerBuildError introduced to replace last uses of TraceError. #​3458
• "spec_unstable_logs_enabled" feature flag is removed. The capability (and the
  backing specification) is now stable and is enabled by default. #​3278

v0.31.0

Compare Source

Released 2025-Sep-25

• Updated opentelemetry and opentelemetry-http dependencies to version 0.31.0.

• Feature: Add span flags support for isRemote property in OTLP exporter (#​3153)

• Updated span and link transformations to properly set flags field (0x100 for local, 0x300 for remote)

• TODO: Placeholder for Span processor related things

  • Fix SpanProcessor::on_start is no longer called on non recording spans

• Fix: Restore true parallel exports in the async-native BatchSpanProcessor by honoring OTEL_BSP_MAX_CONCURRENT_EXPORTS (#​2959). A regression in #​2685 inadvertently awaited the export() future directly in opentelemetry-sdk/src/trace/span_processor_with_async_runtime.rs instead of spawning it on the runtime, forcing all exports to run sequentially.

• Feature: Added Clone implementation to SdkLogger for API consistency with SdkTracer (#​3058).

• Fix: batch size accounting in BatchSpanProcessor when queue is full (#​3089).

• Fix: Resolved dependency issue where the "logs" feature incorrectly
  required the "trace" feature flag
  (#​3096).
  The logs functionality now operates independently, while automatic correlation
  between logs and traces continues to work when the "trace" feature is
  explicitly enabled.

• Fix: Fix shutdown of SimpleLogProcessor and async BatchLogProcessor.

• Default implementation of LogProcessor::shutdown_with_timeout() will now warn to encourage users to implement proper shutdown.

v0.30.0

Compare Source

Released 2025-May-23

• Updated opentelemetry and opentelemetry-http dependencies to version 0.30.0.

• It is now possible to add links to a Span via the SpanRef that you get from
  a Context. 2959

• Feature: Added context based telemetry suppression. #​2868

  • SdkLogger, SdkTracer modified to respect telemetry suppression based on
    Context. In other words, if the current context has telemetry suppression
    enabled, then logs/spans will be ignored.
  • The flag is typically set by OTel
    components to prevent telemetry from itself being fed back into OTel.
  • BatchLogProcessor, BatchSpanProcessor, and PeriodicReader modified to set
    the suppression flag in their dedicated thread, so that telemetry generated from
    those threads will not be fed back into OTel.
  • Similarly, SimpleLogProcessor
    also modified to suppress telemetry before invoking exporters.

• Feature: Implemented and enabled cardinality capping for Metrics by
  default. #​2901

  • The default cardinality limit is 2000 and can be customized using Views.
  • This feature was previously removed in version 0.28 due to the lack of
    configurability but has now been reintroduced with the ability to configure
    the limit.
  • Fixed the overflow attribute to correctly use the boolean value true
    instead of the string "true".
    #​2878

• The shutdown_with_timeout method is added to SpanProcessor, SpanExporter trait and TracerProvider.

• The shutdown_with_timeout method is added to LogExporter trait.

• The shutdown_with_timeout method is added to LogProvider and LogProcessor trait.

• Breaking MetricError, MetricResult no longer public (except when
  spec_unstable_metrics_views feature flag is enabled). OTelSdkResult should
  be used instead, wherever applicable. #​2906

• Breaking change, affecting custom MetricReader authors:

  • The
    shutdown_with_timeout method is added to MetricReader trait.
  • collect
    method on MetricReader modified to return OTelSdkResult.
    #​2905
  • MetricReader
    trait, ManualReader struct, Pipeline struct, InstrumentKind enum moved
    behind feature flag "experimental_metrics_custom_reader".
    #​2928

• Views improvements:

  • Core view functionality is now available by default—users can change the
    name, unit, description, and cardinality limit of a metric via views without
    enabling the spec_unstable_metrics_views feature flag. Advanced view
    features, such as custom aggregation or attribute filtering, still require
    the spec_unstable_metrics_views feature.
  • Removed new_view() method and View trait. Views can now be added by passing
    a function with signature Fn(&Instrument) -> Option<Stream> to the with_view
    method on MeterProviderBuilder.

• Introduced a builder pattern for Stream creation to use with views:

  • Added StreamBuilder struct with methods to configure stream properties
  • Added Stream::builder() method that returns a new StreamBuilder
  • StreamBuilder::build() returns Result<Stream, Box<dyn Error>> enabling
    proper validation.

Example of using views to rename a metric:

let view_rename = |i: &Instrument| {
    if i.name() == "my_histogram" {
        Some(
            Stream::builder()
                .with_name("my_histogram_renamed")
                .build()
                .unwrap(),
        )
    } else {
        None
    }
};

let provider = SdkMeterProvider::builder()
    // add exporters, set resource etc.
    .with_view(view_rename)
    .build();

• Breaking Aggregation enum moved behind feature flag
  "spec_unstable_metrics_views". This was only required when using advanced view
  capabilities.
  #​2928
• Breaking change, affecting custom PushMetricExporter authors:
  • The export method on PushMetricExporter now accepts &ResourceMetrics
    instead of &mut ResourceMetrics.
  • ResourceMetrics no longer exposes scope_metrics field, but instead
    offers scope_metrics() method that returns an iterator over the same.
  • ScopeMetrics no longer exposes metrics field, but instead offers
    metrics() method that returns an iterator over the same.
  • Sum, Gauge, Histogram & ExponentialHistogram no longer exposes
    data_points field, but instead offers data_points() method that returns
    an iterator over the same.
  • SumDataPoint, GaugeDataPoint, HistogramDataPoint &
    ExponentialHistogramDataPoint no longer exposes attributes, exemplars
    field, but instead offers attributes(), and exemplars() method that
    returns an iterator over the same.
  • Exemplar no longer exposes filtered_attributes field, but instead
    offers filtered_attributes() method that returns an iterator over
    the same.
  • HistogramDataPoint no longer exposes bounds and bucket_counts, but
    instead offers bounds() and bucket_counts() methods that returns an
    iterator over the same.
  • Metric no longer exposes name, description, unit, data fields, but
    instead offers name(), description(), unit(), and data() accessor methods.
  • ResourceMetrics no longer exposes resource field, but instead offers
    a resource() accessor method.
  • ScopeMetrics no longer exposes scope field, but instead offers
    a scope() accessor method.

v0.29.0

Compare Source

Released 2025-Mar-21

• Update opentelemetry dependency to 0.29.
• Update opentelemetry-http dependency to 0.29.
• Breaking: The Runtime trait has been simplified and refined. See the #​2641
  for the changes.
• Removed async-std support for Runtime, as async-std crate is deprecated.
• Calls to MeterProviderBuilder::with_resource, TracerProviderBuilder::with_resource,
  LoggerProviderBuilder::with_resource are now additive (#​2677).
• Moved ExportError trait from opentelemetry::trace::ExportError to opentelemetry_sdk::export::ExportError
• Moved TraceError enum from opentelemetry::trace::TraceError to opentelemetry_sdk::trace::TraceError
• Moved TraceResult type alias from opentelemetry::trace::TraceResult to opentelemetry_sdk::trace::TraceResult
• Breaking: Make force_flush() in PushMetricExporter synchronous
• Breaking: Updated the SpanExporter trait method signature:

  fn export(&mut self, batch: Vec<SpanData>) -> BoxFuture<'static, OTelSdkResult>;

to

  fn export(
    &mut self,
    batch: Vec<SpanData>,
) -> impl std::future::Future<Output = OTelSdkResult> + Send;

This affects anyone who writes custom exporters, as custom implementations of SpanExporter
should now define export as an async fn:

  impl trace::SpanExporter for CustomExporter {
    async fn export(&mut self, batch: Vec<trace::SpanData>) -> OTelSdkResult {
        // Implementation here
    }
}

• Breaking The SpanExporter::export() method no longer requires a mutable reference to self.
  Before:

    async fn export(&mut self, batch: Vec<SpanData>) -> OTelSdkResult

  After:

    async fn export(&self, batch: Vec<SpanData>) -> OTelSdkResult

  Custom exporters will need to internally synchronize any mutable state, if applicable.

• Breaking The shutdown_with_timeout method is added to MetricExporter trait. This is breaking change for custom MetricExporter authors.

• Bug Fix: BatchLogProcessor now correctly calls shutdown on the exporter
  when its shutdown is invoked.

• Reduced some info level logs to debug

• Breaking for custom LogProcessor/Exporter authors: Changed name
  parameter from &str to Option<&str> in event_enabled method on the
  LogProcessor and LogExporter traits. SdkLogger no longer passes its
  scope name but instead passes the incoming name when invoking
  event_enabled on processors.

• Breaking for custom LogExporter authors: shutdown() method in
  LogExporter trait no longer requires a mutable ref to self. If the exporter
  needs to mutate state, it should rely on interior mutability.
  2764

• Breaking (Affects custom Exporter/Processor authors only) Removed
  opentelemetry_sdk::logs::error::{LogError, LogResult}. These were not
  intended to be public. If you are authoring custom processor/exporters, use
  opentelemetry_sdk::error::OTelSdkError and
  opentelemetry_sdk::error::OTelSdkResult.
  2790

• Breaking for custom LogProcessor authors: Changed set_resource
  to require mutable ref.
  fn set_resource(&mut self, _resource: &Resource) {}

• Breaking: InMemoryExporter's return type change.

  • TraceResult<Vec<SpanData>> to Result<Vec<SpanData>, InMemoryExporterError>
  • MetricResult<Vec<ResourceMetrics>> to Result<Vec<ResourceMetrics>, InMemoryExporterError>
  • LogResult<Vec<LogDataWithResource>> to Result<Vec<LogDataWithResource>, InMemoryExporterError>

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[wiz-0f98cca50a]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	4  3  4
Sensitive Data	-
Secrets	-
IaC Misconfigurations	-
SAST Findings	-
Software Management Findings	-
Total	4  3  4

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio.