Skip to contentOpen-telemetry Opentelemetry-go vulnerabilities
- open-telemetry opentelemetry-goOpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871Fix available6.3 Medium
- open-telemetry opentelemetry-goOpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872Fix available6.3 Medium
- open-telemetry opentelemetry-goOpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationCVE-2026-81869Fix available5.1 Medium
- open-telemetry opentelemetry-goOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsCVE-2026-81870Fix available2.0 Low
- open-telemetry opentelemetry-goOpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent accessCVE-2026-45404Fix available5.9 Medium
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +4 more +6 moreOpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijackingCVE-2026-39883Public exploitFix available7.3 High
- open-telemetry opentelemetry-go, opentelemetry +1 moreOpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesCVE-2026-39882Fix available5.3 Medium
- open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +7 more +9 moreOpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)CVE-2026-29181Fix available7.5 High
- open-telemetry opentelemetry-go, opentelemetry +1 moreOpenTelemetry-Go Affected by Arbitrary Code Execution via PATH HijackingCVE-2026-24051Fix available7.0 High
- opentelemetry, open-telemetry opentelemetry-go-contrib +1 moreDoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsCVE-2023-47108Public exploitFix available7.5 High
- opentelemetry, open-telemetry opentelemetry-go-contrib +1 moreOpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metricsCVE-2023-45142Fix available7.5 High
- open-telemetry opentelemetry-go-contrib, linuxfoundation opentelemetry-go contrib +1 moreDoS vulnerability for high cardinality metrics in opentelemetry-go-contribCVE-2023-25151Fix available7.5 High