953 matches found
CVE-2026-45404
OpenTelemetry-Go versions 0.11.0 through 1.44.0 contain an unsynchronized extraBaggageItems map in the OpenTracing bridge's bridgeSpan. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can t...
CVE-2026-45404
creationtimestamp| type| source ---|---|--- 2026-08-20 18:35:13+00:00| published-proof-of-concept| https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p...
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Summary go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal...
GHSA-42CJ-99W8-CP2P OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Summary go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal...
GO-2026-6094 vulnerabilities
Vulnerabilities for packages: kots, kube-vip-cloud-provider, flux-kustomize-controller, pulumi-kubernetes-operator, rke2-cloud-provider, k3s, gitlab-kas, cert-manager-webhook-pdns, openfga, cluster-autoscaler, cluster-api, spicedb, fluent-operator, kapp-controller, metrics-server, spqr,...
PT-2026-80733
Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions 0.11.0 through 1.44.0 Description The OpenTracing bridge contains an unsynchronized extraBaggageItems map within the bridgeSpan component. Because Go maps do not support safe concurrent read and write access,...
ROOT-APP-NPM-CVE-2026-44902 CVE-2026-44902 in @opentelemetry/auto-instrumentations-node - Patched by Root
Root has patched CVE-2026-44902 in the @opentelemetry/auto-instrumentations-node package for Root:npm. Multiple fixed versions available...
GO-2024-2911 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector, opentelemetry-collector-contrib, tempo, spicedb...
GO-2024-2900 vulnerabilities
Vulnerabilities for packages: opentelemetry-collector-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector, opentelemetry-collector-contrib, tempo...
GO-2025-3650 vulnerabilities
Vulnerabilities for packages: grafana-alloy-fips, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib, sqlexporter, grafana-alloy, splunk-otel-collector-fips, splunk-otel-collector, sqlexporter-fips, vault...
GO-2024-3110 vulnerabilities
Vulnerabilities for packages: kubernetes, eks-distro-fips, eks-distro, runc, gosu, k8s-device-plugin, opentelemetry-collector-contrib, kubernetes-fips, podman, k3s, opentelemetry-collector-contrib-fips, docker, neuvector, grafana-alloy, syft, grype, neuvector-scanner, cluster-autoscaler,...
GO-2024-2791 vulnerabilities
Vulnerabilities for packages: wolfictl, kubernetes, opentelemetry-collector-contrib-fips, opentelemetry-collector-contrib, buildah, cadvisor-fips, grype, cadvisor, ctop, neuvector-scanner...
GO-2026-4399 vulnerabilities
Vulnerabilities for packages: gitlab-operator, mariadb-operator-fips, aws-privateca-issuer-fips, percona-server-mongodb-operator, percona-server-mongodb-operator-fips, aws-privateca-issuer, cert-manager-istio-csr, step-issuer, cert-manager-cmctl-fips, opentelemetry-operator-fips,...
GO-2025-3525 vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines, k8sgpt, eks-distro-fips, opentelemetry-collector, argo-cd, eks-distro, tempo, kargo, opentelemetry-collector-fips, opentelemetry-collector-contrib, argo-cd-fips, argo-workflows, splunk-otel-collector-fips, argo-rollouts, nats,...
GO-2025-4123 vulnerabilities
Vulnerabilities for packages: vault-fips, sqlexporter, sqlexporter-fips, opentelemetry-collector-contrib, telegraf, splunk-otel-collector-fips, bento, argo-events-fips, vault, dapr, cluster-api-aws-controller-fips, grafana-alloy, amazon-cloudwatch-agent, dapr-fips, jitsucom-bulker,...
GO-2026-5381 vulnerabilities
Vulnerabilities for packages: aws-otel-collector, loki-fips, aws-otel-collector-fips, cloudzero-agent-fips, nrdot-collector-k8s-fips, k8sgpt, tempo-fips, node-problem-detector-fips, cloud-sql-proxy-fips, opentelemetry-collector, trillian-fips, datadog-agent, jaeger-fips, tempo,...
GO-2026-5710 vulnerabilities
Vulnerabilities for packages: aws-otel-collector, loki-fips, aws-otel-collector-fips, cloudzero-agent-fips, prometheus-operator, k8sgpt, opentelemetry-collector-k8s-fips, node-problem-detector-fips, cloud-sql-proxy-fips, grafana, tempo-fips, opentelemetry-collector, trillian-fips,...
GO-2024-2911 vulnerabilities
Vulnerabilities for packages: spicedb, opentelemetry-collector-contrib, opentelemetry-collector, tempo...