Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-telemetry | go.opentelemetry.io/otel/schema/v1.1 | < 0.0.17 | — |
| open-telemetry | go.opentelemetry.io/otel/schema/v1.0 | < 0.0.17 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-opentelemetry-otel | 1.46.0-2 | — |
| Debian 13 | golang-opentelemetry-otel | No fix yet | — |
| Debian 12 | golang-opentelemetry-otel | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 26.04 LTS | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 25.10 | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 24.04 LTS | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 22.04 LTS | golang-opentelemetry-otel | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | buildah +1 | 1.44.0-1.hum1 | RHSA-2026:23263 |
| Red Hat Hardened Images 1 | caddy | 2.11.4-0.1.hum1 | RHSA-2026:25238 |
| Red Hat Hardened Images 1 | containers-common +1 | 0.67.0-1.1.hum1 | RHSA-2026:7420 |
| Red Hat Hardened Images 1 | cosign | 3.1.1-0.1.hum1 | RHSA-2026:25138 |
| Red Hat Hardened Images 1 | hugo | 0.162.1-1.hum1 | RHSA-2026:24577 |
| Red Hat Hardened Images 1 | kubernetes1.35 +3 | 1.35.6-1.hum1 | RHSA-2026:25535 |
| Red Hat Hardened Images 1 | podman +5 | 5.8.2-1.1.hum1 | RHSA-2026:15859 |
| Red Hat Hardened Images 1 | skopeo +1 | 1.23.0-1.hum1 | RHSA-2026:21399 |
| Red Hat Hardened Images 1 | syft | 1.45.1-0.1.hum1 | RHSA-2026:25137 |
| Red Hat Hardened Images 1 | trivy | 0.69.3-1.2.hum1 | RHSA-2026:15862 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.opentelemetry.io/otel/schema | < 0.0.17 | 0.0.17 | GHSA-995v-fvrw-c78m |
| Go | go.opentelemetry.io/otel/schema/v1.0 | < 0.0.17 | 0.0.17 | GHSA-995v-fvrw-c78m |
| Go | go.opentelemetry.io/otel/schema/v1.1 | < 0.0.17 | 0.0.17 | GHSA-995v-fvrw-c78m |
Advisories 11
- RHSA-2026:15862 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:7420 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25535 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25238 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25138 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:25137 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24577 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:23263 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:21399 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:15859 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026