OpenTelemetry-Go vulnerabilities

OpenTelemetry-Go versions 0.11.0 through 1.44.0 have a panic vulnerability in the OpenTracing bridge due to an unsynchronized extraBaggageItems map, causing concurrent access issues and denial of service. Fixed in 1.45.0.

OpenTelemetry-Go prior to version 0.0.17 leaks one file descriptor on each successful `ParseFile` call. Repeated parsing in a long-running process can exhaust the file descriptor limit and cause denial of service.

OpenTelemetry-Go versions 1.41.0 and 1.43.0 removed raw-length rejection, causing `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

In OpenTelemetry-Go from 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

The OpenTelemetry-Go library prior to version 1.43.0 reads the full HTTP response body into an in-memory buffer without a size cap, which can lead to memory exhaustion when the configured collector endpoint is attacker-controlled or when the connection is intercepted.

OpenTelemetry-Go versions 1.36.0 to 1.40.0 process 'baggage' headers in a way that allows an attacker to amplify CPU and memory allocation by sending many header lines, even if each value is within the 8192-byte limit.