Vulnerability Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opentelemetry | Telemetry Schema Files | < 0.0.17 |
Related Weaknesses (CWE)
References
- https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd8Patch
- https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d6570Patch
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995vExploitVendor Advisory
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995vExploitVendor Advisory
FAQ
What is CVE-2026-45287?
CVE-2026-45287 is a vulnerability with a CVSS score of 5.5 (MEDIUM). OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each...
How severe is CVE-2026-45287?
CVE-2026-45287 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45287?
Check the references section above for vendor advisories and patch information. Affected products include: Opentelemetry Telemetry Schema Files.