OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.
References
Configurations
History
18 Jun 2026, 14:32
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684 - Patch | |
| References | () https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d - Patch | |
| References | () https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m - Exploit, Vendor Advisory | |
| CPE | cpe:2.3:a:opentelemetry:telemetry_schema_files:*:*:*:*:*:go:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| First Time |
Opentelemetry
Opentelemetry telemetry Schema Files |
08 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m - |
04 Jun 2026, 16:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-04 16:16
Updated : 2026-06-18 14:32
NVD link : CVE-2026-45287
Mitre link : CVE-2026-45287
CVE.ORG link : CVE-2026-45287
JSON object : View
Products Affected
opentelemetry
- telemetry_schema_files