Open-telemetry vulnerabilities
62 CVEs and advisories name Open-telemetry as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-118259opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing
- CVE-2026-116694OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
- CVE-2026-114603OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
- CVE-2026-104872Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
- CVE-2026-81871OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
- CVE-2026-81872OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
- CVE-2026-81869OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation
- CVE-2026-81870OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs
- CVE-2026-55701OpenTelemetry githubreceiver silently ignores configured required_headers authentication
- CVE-2026-47256OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token
- CVE-2026-47701OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
- CVE-2026-48496opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent
- CVE-2026-81192OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
- CVE-2026-45404OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
- CVE-2026-48504OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation
- CVE-2026-59892OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header
- CVE-2026-54712OpenTelemetry Javaagent RMI context propagation allows resource exhaustion
- CVE-2026-54704OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords
- CVE-2026-54285opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation
- CVE-2026-44967opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response
- CVE-2026-45287OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse
- CVE-2026-41178OpenTelemetry-Go's baggage parsing no longer caps raw header length
- CVE-2026-45686OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI
- CVE-2026-45685OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages
- CVE-2026-45684OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers
- CVE-2026-45683OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure
- CVE-2026-45681OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size
- CVE-2026-45680OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU
- CVE-2026-45679OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages
- CVE-2026-45678OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads