Skip to main content
cve.nowby Sazabi
← Go
GoPackage

go.opentelemetry.io/otel

2 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
v1.47.0 (Oct 2, 2026): no advisory affects it
Newest unaffected release
v1.47.0 (Oct 2, 2026), the latest release
Advisories
2 · 1 high, 1 medium
Releases
94 since v0.1.0 (Nov 4, 2019)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-41178
    Affects v1.41.0 (v1.42.0 is outside it); v1.43.0 (v1.44.0 is outside it)
  • CVE-2026-29181
    Affects v1.36.0 to v1.40.0 (v1.41.0 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

  • CVE-2026-41178Medium 5.3

    OpenTelemetry-Go's baggage parsing no longer caps raw header length

    Affected: from 1.41.0, fixed in 1.42.0; from 1.43.0, fixed in 1.44.0.

    Fixed in v1.42.0 (released Mar 6, 2026, 90 days before disclosure) and v1.44.0 (released May 27, 2026, 8 days before disclosure).

    The latest release, v1.47.0, is not affected.

  • OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

    Affected: from 1.36.0, fixed in 1.41.0.

    Fixed in v1.41.0 (released Mar 2, 2026, 36 days before disclosure).

    The latest release, v1.47.0, is not affected.