تخطَّ إلى المحتوى
QuenchWorks

VEXDocumentDB

DocumentDB

1 بيان, صدرت في .كل بيان نتيجةٌ من الماسح غير قابلة للاستغلال في هذه الصورة، مع السبب.

الصورةOpenVEX JSON

@id https://quench-works.com/vex/documentdb/2026-10-13

  1. CVE-2026-48504

    غير متأثر · الشيفرة المعرّضة خارج مسار التنفيذ
    • opentelemetry_sdk 0.30.0

    CVE-2026-48504 is unbounded parsing of an inbound W3C baggage header in opentelemetry_sdk BaggagePropagator::extract_with_context. The documentdb gateway (pg_documentdb_gw) ships opentelemetry_sdk 0.30.0 on the 0.114-0 and 0.116-0 lines; 0.117-0 already carries the fixed 0.32.1, and 0.30 to 0.32 is a breaking bump. grep for Baggage over pg_documentdb_gw at v0.114-0 and v0.116-0 returned 0 matches. v0.116-0 installs only TraceContextPropagator (documentdb_gateway_core/src/telemetry/telemetry_manager.rs:100) and parses traceparent itself from the request comment (telemetry/context_propagation.rs:38, no propagator); v0.114-0 installs no propagator at all. The MongoDB wire protocol carries no baggage header, so BaggagePropagator is never constructed. The recipe fails the build if any gateway source names a Baggage type. Verified 2026-10-13.