Allocation of Resources Without Limits or Throttling

Overview OpenTelemetry.Exporter.Jaeger is a Jaeger exporter for OpenTelemetry .NET Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the span and tag conversion. An attacker can drive sustained memory pressure and denial of service by...

PT-2026-33598

Name of the Vulnerable Software and Affected Versions OpenTelemetry.Exporter.Jaeger affected versions not specified Description This issue allows sustained memory pressure when the internal pooled-list sizing grows based on a large observed span or tag set and that enlarged size is reused for...

OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

Summary A flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is running with elevated privileges. The injector trusted TMPDIR from the target process and used unsafe file creation...

PT-2026-35073

Name of the Vulnerable Software and Affected Versions OpenTelemetry eBPF Instrumentation versions 0.4.0 through 0.7.x Description A flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and the...

GHSA-F5V8-V6Q3-Q4H6 Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)

Summary Meridian v2.1.0 Meridian.Mapping and Meridian.Mediator shipped with nine defense-in-depth gaps reachable through its public APIs. Two are HIGH severity — the advertised DefaultMaxCollectionItems and DefaultMaxDepth safety caps are silently bypassed on the IMapper.Mapsource, destination...

CLEANSTART-2026-WW53101 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Multiple security vulnerabilities affect the distribution package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-YF74364 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Multiple security vulnerabilities affect the tempo package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-PM81907 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Multiple security vulnerabilities affect the prometheus package. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

...

OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies

...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: k8ssandra-client, trivy, k3s, go, kubernetes-csi-driver-nfs, rancher-fleet, timoni, tofu-controller, falcoctl, mattermost, cosign, buildah, rclone, tkn, aws-flb-kinesis, spire-server, kpt, cilium-cli, nats-server, falco-no-driver, sonobuoy, newrelic-fluent-bit-output...

CVE-2026-32282 vulnerabilities

Vulnerabilities for packages: fscrypt, cilium, helm, go, k3s, aactl, runc, k8s-device-plugin, karpenter, aws-flb-firehose, mattermost, external-dns, aws-flb-kinesis, spire-server, redka, libnvidia-container, cilium-cli, flux, falco-no-driver, snyk-cli, cloud-provider-aws, kaf,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: lazydocker, argo-rollouts, k8ssandra-client, k3s, trivy, go, jitsucom-bulker, temporal, sftpgo-plugin-auth, azure-service-operator, kubernetes-csi-driver-nfs, rancher-fleet, timoni, tofu-controller, falcoctl, verticadb-operator, mattermost,...

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak

A flaw was found in OpenTelemetry-Go before schema package version 0.0.17. ParseFile in go.opentelemetry.io/otel/schema/v1.0 and v1.1 opens a schema file and passes it to Parse without closing it, leaking one file descriptor per successful call. Repeated parsing in a long-running process can...

CVE-2026-39882

A flaw was found in OpenTelemetry-Go. The otlp HTTP exporters read the full HTTP response body into an in-memory buffer without a size cap. A remote attacker, by controlling the collector endpoint or performing a man-in-the-middle MITM attack on the exporter connection, can exploit this to cause...

Linux Distros Unpatched Vulnerability : CVE-2026-29181

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value...

AZL-82082 CVE-2026-39882 affecting package azl-otel-collector 0.127.0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

CVE-2026-39883

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This...

AZL-82193 CVE-2026-39882 affecting package docker-compose for versions less than 2.27.0-9

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

UBUNTU-CVE-2026-39883

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms. This...