Open-telemetry vulnerabilities

Products

• Opentelemetry-ebpf-instrumentation 11
• Opentelemetry-go 9
• Opentelemetry-dotnet 8
• Opentelemetry-dotnet-contrib 6
• Opentelemetry-collector-contrib 5
• Opentelemetry-java-instrumentation 4
• Opentelemetry-go-contrib 3
• Opentelemetry-js 3
• Opentelemetry-java 2
• Opentelemetry-python 2

Newest

• open-telemetry opentelemetry-java opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing CVE-2026-118259 Fix available 5.3 MediumOctober 28, 2026
• open-telemetry opentelemetry-python OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation CVE-2026-116694 Fix available 6.3 MediumOctober 27, 2026
• open-telemetry opentelemetry-python OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api CVE-2026-114603 Fix available 5.3 MediumOctober 22, 2026
• @opentelemetry instrumentation-cassandra-driver, instrumentation-knex, instrumentation-mongoose +6 more +8 more Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute CVE-2026-104872 Fix available 5.8 MediumOctober 2, 2026
• open-telemetry opentelemetry-go OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning CVE-2026-81871 Fix available 6.3 MediumSeptember 16, 2026
• open-telemetry opentelemetry-go OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full CVE-2026-81872 Fix available 6.3 MediumSeptember 16, 2026
• open-telemetry opentelemetry-go OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation CVE-2026-81869 Fix available 5.1 MediumSeptember 16, 2026
• open-telemetry opentelemetry-go OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs CVE-2026-81870 Fix available 2.0 LowSeptember 16, 2026
• open-telemetry opentelemetry-dotnet-contrib OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS CVE-2026-81192 Fix available 7.0 HighSeptember 8, 2026
• open-telemetry opentelemetry-go OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access CVE-2026-45404 Fix available 5.9 MediumAugust 20, 2026
• open-telemetry opentelemetry-js OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVE-2026-59892 Fix available 7.5 HighJuly 8, 2026
• linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation +1 more OpenTelemetry Javaagent RMI context propagation allows resource exhaustion CVE-2026-54712 Fix available 5.3 MediumJuly 1, 2026
• linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation +1 more OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords CVE-2026-54704 Fix available 6.5 MediumJuly 1, 2026
• open-telemetry opentelemetry-rust OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation CVE-2026-48504 Fix available 5.3 MediumJune 25, 2026
• open-telemetry opentelemetry-ebpf-profiler opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent CVE-2026-48496 Fix available 6.2 MediumJune 23, 2026
• open-telemetry github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver, opentelemetry-collector-contrib +1 more OpenTelemetry githubreceiver silently ignores configured required_headers authentication CVE-2026-55701 Fix available 6.9 MediumJune 18, 2026
• open-telemetry github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter, opentelemetry-collector-contrib +1 more OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token CVE-2026-47256 Fix available 5.3 MediumJune 18, 2026
• open-telemetry opentelemetry-js, opentelemetry +1 more opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation CVE-2026-54285 Fix available 5.3 MediumJune 15, 2026
• open-telemetry opentelemetry-cpp, opentelemetry +1 more opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVE-2026-44967 Fix available 5.3 MediumJune 12, 2026
• open-telemetry opentelemetry-operator OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth CVE-2026-47701 Fix available 7.7 HighJune 10, 2026
• open-telemetry go.opentelemetry.io/otel/schema/v1.0, go.opentelemetry.io/otel/schema/v1.1, opentelemetry telemetry schema files +2 more OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse CVE-2026-45287 Fix available 2.1 LowMay 28, 2026
• opentelemetry, open-telemetry go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation +2 more OpenTelemetry-Go's baggage parsing no longer caps raw header length CVE-2026-41178 Fix available 5.3 MediumMay 28, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVE-2026-45686 Fix available 7.5 HighMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVE-2026-45685 Fix available 7.5 HighMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers CVE-2026-45684 Fix available 4.9 MediumMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals CVE-2026-45682 Fix available 5.1 MediumMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure CVE-2026-45683 Fix available 3.8 LowMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size CVE-2026-45681 Fix available 5.9 MediumMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU CVE-2026-45680 Fix available 5.9 MediumMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVE-2026-45678 Fix available 7.5 HighMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages CVE-2026-45679 Fix available 6.5 MediumMay 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent CVE-2026-45676 Fix available 5.5 MediumMay 18, 2026
• io.opentelemetry opentelemetry-api, opentelemetry-extension-trace-propagators, open-telemetry opentelemetry-java +17 more +19 more opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation CVE-2026-45292 Fix available 5.3 MediumMay 14, 2026
• open-telemetry opentelemetry-js, @opentelemetry auto-instrumentations-node, exporter-prometheus +4 more +6 more opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVE-2026-44902 Fix available 7.5 HighMay 11, 2026
• open-telemetry opentelemetry-dotnet-contrib OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured CVE-2026-44213 Fix available 6.5 MediumMay 8, 2026
• open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 more azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay CVE-2026-42602 Fix available 8.1 HighMay 6, 2026
• opentelemetry opentelemetry.opamp.client, open-telemetry opentelemetry-dotnet-contrib +1 more OpAMP client reads unbounded HTTP response bodies CVE-2026-42348 Fix available 5.9 MediumMay 5, 2026
• opentelemetry opentelemetry.exporter.opentelemetryprotocol, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter CVE-2026-42191 Fix available 6.5 MediumApril 30, 2026
• opentelemetry opentelemetry.exporter.onecollector, open-telemetry opentelemetry-dotnet-contrib +1 more OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body CVE-2026-41484 Fix available 5.3 MediumApril 29, 2026
• opentelemetry opentelemetry.resources.azure, open-telemetry opentelemetry-dotnet-contrib +1 more Unbounded HTTP response body read in OpenTelemetry.Resources.Azure CVE-2026-41483 Fix available 5.9 MediumApril 29, 2026
• opentelemetry opentelemetry.exporter.zipkin, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth CVE-2026-41310 Fix available 5.3 MediumApril 28, 2026
• open-telemetry opentelemetry-dotnet-contrib Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS CVE-2026-41173 Fix available 5.9 MediumApril 23, 2026
• open-telemetry opentelemetry.api, opentelemetry.extensions.propagators, opentelemetry +1 more +3 more OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers CVE-2026-40894 Fix available 5.3 MediumApril 23, 2026
• opentelemetry, open-telemetry opentelemetry-dotnet, opentelemetry.exporter.opentelemetryprotocol +2 more OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling CVE-2026-40891 Fix available 5.3 MediumApril 23, 2026
• opentelemetry, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies CVE-2026-40182 Fix available 5.3 MediumApril 23, 2026
• open-telemetry opentelemetry.exporter.jaeger, opentelemetry, open-telemetry opentelemetry-dotnet +2 more OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path CVE-2026-41078 5.9 MediumApril 18, 2026
• opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR CVE-2026-41433 Fix available 8.4 HighApril 17, 2026
• open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +4 more +6 more OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking CVE-2026-39883 Fix available 7.3 HighApril 8, 2026
• open-telemetry opentelemetry-go, opentelemetry +1 more OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies CVE-2026-39882 Fix available 5.3 MediumApril 8, 2026
• open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +7 more +9 more OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVE-2026-29181 Fix available 7.5 HighApril 7, 2026
• Show olderLoading…