Vendor

open-telemetry

62 known vulnerabilities.

Products

opentelemetry-ebpf-instrumentation 11 opentelemetry-go 9 opentelemetry-dotnet 8 opentelemetry-dotnet-contrib 6 opentelemetry-collector-contrib 5 opentelemetry-java-instrumentation 4 opentelemetry-js 3 opentelemetry-go-contrib 3 opentelemetry-python 2 opentelemetry-java 2 OpenTelemetry.Api 1 OpenTelemetry.Extensions.Propagators 1 opentelemetry-python-contrib 1 opentelemetry-operator 1 github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter 1 OpenTelemetry.Exporter.OpenTelemetryProtocol 1 go.opentelemetry.io/otel/schema/v1.1 1 go.opentelemetry.io/otel/schema/v1.0 1 opentelemetry-rust 1 opentelemetry-collector 1 go.opentelemetry.io/otel/baggage 1 go.opentelemetry.io/otel/propagation 1 opentelemetry-js-contrib 1 OpenTelemetry.Exporter.Jaeger 1 github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver 1 opentelemetry-cpp 1 opentelemetry-ebpf-profiler 1

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

High 7.3

CVE-2026-39883 Public exploit

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on …

open-telemetry opentelemetry-go golang-opentelemetry-otel go.opentelemetry.io/otel/sdk Ubuntu Go

Apr 8, 2026
Critical 9.3

CVE-2026-33701 Public exploit

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serializa…

open-telemetry opentelemetry-java-instrumentation io.opentelemetry.javaagent:opentelemetry-javaagent Maven

Mar 27, 2026
High 7.5

CVE-2023-47108 Public exploit

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have…

open-telemetry opentelemetry-go-contrib golang-opentelemetry-contrib go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc Ubuntu Go

Nov 10, 2023

open-telemetry

Products

OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics