CVE catalog

CVE-2026-45287

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each

[CVE catalog]

Severity
Medium · CVSS 4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-opentelemetry-otelsid1.46.0-3fixed
Debiangolang-opentelemetry-otelforky1.46.0-2fixed
Debiangolang-opentelemetry-oteltrixie1.31.0-4vulnerable
Debiangolang-opentelemetry-otelbookworm1.1.0-2vulnerable
Cpegolang-opentelemetry-otelNot reportedNot reportedvulnerable
Cpetelemetry_schema_filesNot reported0.0.17fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-opentelemetry-otelsourcesid1.46.0-2not yet assignedNot reported[1139168]
Debiangolang-opentelemetry-otelsourceforky1.46.0-2not yet assignedNot reported[1139168]
Debiangolang-opentelemetry-otelsourcetrixie(unfixed)not yet assignedNot reported[1139168]
Debiangolang-opentelemetry-otelsourcebookworm(unfixed)not yet assignedNot reported[1139168]
Cpetelemetry_schema_filescpeNot reported0.0.17Not reportedNot reportedNot reported

[Debian bug #1139168]

Notes

[trixie] golang-opentelemetry-otel: Minor issue [bookworm] golang-opentelemetry-otel: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-opentelemetry-otel-dev]Affected

    Source package: [golang-opentelemetry-otel]

    Details (2)

    • 1.1.0-2 · all · bookworm

      Affected

      nvd · golang-opentelemetry-otel · debian · bookworm; nvd · golang-opentelemetry-otel · debian · 12

    • 1.1.0-2 · all · bookworm

      Affected

      nvd · golang-opentelemetry-otel · debian · bookworm; nvd · golang-opentelemetry-otel · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]