CVE-2026-128085

A flaw was found in OpenTelemetry-Go. This vulnerability can lead to a Denial of Service DoS through excessive memory consumption. When processing telemetry data such as spans, logs, or traces, the attribute length truncation mechanism fails to account for valid Unicode replacement characters. A...

CVE-2026-128086

A flaw was found in OpenTelemetry Go. A remote, unauthenticated attacker can exploit this vulnerability by sending HTTP requests containing densely populated baggage headers to an exposed endpoint. Because the baggage parser eagerly allocates memory objects for every metadata property within the...

CVE-2026-128086

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...

CVE-2026-128085

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and...

GHSA-RRFC-GJM9-CGRJ OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

Summary OpenTelemetry Go eagerly materializes W3C baggage metadata into property objects during parsing. Slice growth, serialization, and copying into the internal representation cause bounded but disproportionate memory-allocation amplification for a valid, densely populated header. In v1.46.0 a...

OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

Summary OpenTelemetry Go eagerly materializes W3C baggage metadata into property objects during parsing. Slice growth, serialization, and copying into the internal representation cause bounded but disproportionate memory-allocation amplification for a valid, densely populated header. In v1.46.0 a...

GHSA-Q7GW-24FR-5P69 opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

Summary The AttributeValueLengthLimit span/log-record limit can be bypassed entirely with attribute values that consist of valid U+FFFD REPLACEMENT CHARACTER runes. The counting-based truncation introduced by the fix for GHSA-p9f8-wvj8-2fg8 commit e016a78c9, first released in v1.33.0 has an...

opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

Summary The AttributeValueLengthLimit span/log-record limit can be bypassed entirely with attribute values that consist of valid U+FFFD REPLACEMENT CHARACTER runes. The counting-based truncation introduced by the fix for GHSA-p9f8-wvj8-2fg8 commit e016a78c9, first released in v1.33.0 has an...

CVE-2026-128086 OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...

EUVD-2026-125716

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members, and copy properties into...

CVE-2026-128086

The OpenTelemetry-Go Go implementation (go.opentelemetry.io/otel) contains a vulnerability where baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property. This behavior causes bounded but disproportionate memory-allocation amplification when processing valid, d...

CVE-2026-128085

The OpenTelemetry-Go library contains a defect where the AttributeValueLengthLimit is bypassed by attribute values composed of valid U+FFFD (REPLACEMENT CHARACTER) runes. In versions 1.33.0 (SDK), 0.9.0 (SDK log), and 1.35.0 (trace) through 1.47.0 , the optimistic truncation path fails to count t...

EUVD-2026-125715

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and...

CVE-2026-128085 opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and...

CLEANSTART-2026-AW32046 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the kubernetes package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-XY43119 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the rabbitmq-messaging-topology-operator package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2025-SC39439 OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go

Security vulnerability affects the k3s package. OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go...

CLEANSTART-2026-CH28846 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-24051 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-XG73192 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-39882 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-RQ28905 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-39883 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...