379 matches found
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration
A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...
GO-2026-6505 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace
OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace...
CLEANSTART-2026-ST13970 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
Rocky Linux 9 [CIQ] Security Update: image-builder / image-builder-debuginfo / image-builder-debugsource Multiple Vulnerabilities (crlsa-2026_67138)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202667138 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...
SUSE CVE-2026-81870
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...
CLEANSTART-2026-ZE06453 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81871 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-YB58885 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
EUVD-2026-81261
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full...
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
Summary A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries an...
GHSA-HJF4-FPHR-2H65 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
Summary A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries an...
GHSA-P9F8-WVJ8-2FG8 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...
EUVD-2026-81260
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation...
OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
Summary The OpenTelemetry Go SDK trace package can fail to enforce AttributeValueLengthLimit for string attributes containing the valid Unicode replacement character U+FFFD. An oversized attacker-controlled attribute value that includes U+FFFD is returned untruncated, bypassing the configured...
CLEANSTART-2026-NU58137 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the opentelemetry-collector-contrib package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-AL44368 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
CLEANSTART-2026-EC67398 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-41178 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...
GO-2026-6508 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc...
CLEANSTART-2026-ZA34964 OpenTelemetry-Go is the Go implementation of OpenTelemetry
Security vulnerability affects the loki package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...
CLEANSTART-2026-HD45306 OpenTelemetry-Go is the Go implementation of OpenTelemetry
CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...