Skip to content
OpenAdvisories

Product · open-telemetry

opentelemetry-go

11 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-128086

    OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members,…

    open-telemetry opentelemetry-go go.opentelemetry.io/otel/baggage go.opentelemetry.io/otel/propagation Go
  • Medium 5.3
    CVE-2026-128085

    opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnor…

    open-telemetry opentelemetry-go go.opentelemetry.io/otel/sdk go.opentelemetry.io/otel/sdk Go
  • Medium 6.3
    CVE-2026-81871

    OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables…

    open-telemetry opentelemetry-go zot kots Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.3
    CVE-2026-81872

    OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is…

    open-telemetry opentelemetry-go kubescape guac Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.1
    CVE-2026-81869

    OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode rep…

    open-telemetry opentelemetry-go cri-o kubernetes Debian Ubuntu Azure Linux Go
  • Medium 5.9
    CVE-2026-45404

    OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/writ…

    open-telemetry opentelemetry-go cortex pulumi-language-yaml Debian Ubuntu Wolfi Go
  • Medium 5.3
    CVE-2026-39882

    OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies

    OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the c…

    open-telemetry opentelemetry-go zot kubescape Debian Ubuntu Azure Linux Wolfi Go