CVE-2026-45287
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
OpenTelemetry-Go prior to version 0.0.17 leaks one file descriptor on each successful `ParseFile` call. Repeated parsing in a long-running process can exhaust the file descriptor limit and cause denial of service.
Risk Assessment
The risk is that an attacker controlling the file path for parsing can exhaust system resources, leading to service unavailability.
Recommendation
Update OpenTelemetry-Go to version 0.0.17 or later, which includes a fix.
Other vulnerabilities in OpenTelemetry-Go
See all- CVE-2026-45404Medium
OpenTelemetry-Go versions 0.11.0 through 1.44.0 have a panic vulnerability in the OpenTracing bridge due to an unsynchronized extraBaggageItems map, causing concurrent access issues and denial of service. Fixed in 1.45.0.
- CVE-2026-41178Medium
OpenTelemetry-Go versions 1.41.0 and 1.43.0 removed raw-length rejection, causing `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
- CVE-2026-39883High
In OpenTelemetry-Go from 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.
- CVE-2026-39882Medium
The OpenTelemetry-Go library prior to version 1.43.0 reads the full HTTP response body into an in-memory buffer without a size cap, which can lead to memory exhaustion when the configured collector endpoint is attacker-controlled or when the connection is intercepted.
- CVE-2026-29181High
OpenTelemetry-Go versions 1.36.0 to 1.40.0 process 'baggage' headers in a way that allows an attacker to amplify CPU and memory allocation by sending many header lines, even if each value is within the 8192-byte limit.
Original NVD description (English source)
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.