CVE-2026-116694: CVE-2026-116694: Unbounded Memory Allocation and Denial of Service in OpenTelemetry Python Jaeger Propagator

Two vulnerabilities were reported on 2026-10-27. CVE-2026-116685 affects MCP Python SDK versions 1.8.0-1.29.1 and 2.0.0-2.1.1, where HTTP-based client transports unconditionally enable automatic redirects across origin boundaries, risking credential and payload disclosure. Simultaneously, CVE-2026-116694 impacts the OpenTelemetry Python SDK Jaeger propagator before version 1.45.0. This flaw involves unbounded resource allocation in JaegerPropagator.extract(), as it processes 'uberctx-' headers without limits on entry count or size, potentially leading to a Denial of Service.