# cve.now: Open-telemetry

The newest entries naming Open-telemetry as an affected vendor (up to 200), of 62 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118259](https://cve.now/CVE-2026-118259.md): opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing (CVSS 5.3)
- [CVE-2026-116694](https://cve.now/CVE-2026-116694.md): OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation (CVSS 6.3)
- [CVE-2026-114603](https://cve.now/CVE-2026-114603.md): OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api (CVSS 5.3)
- [CVE-2026-104872](https://cve.now/CVE-2026-104872.md): Multiple @opentelemetry/instrumentation-\* packages expose database username via unconditional db.user span attribute (CVSS 5.8)
- [CVE-2026-81871](https://cve.now/CVE-2026-81871.md): OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning (CVSS 6.3)
- [CVE-2026-81872](https://cve.now/CVE-2026-81872.md): OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full (CVSS 6.3)
- [CVE-2026-81869](https://cve.now/CVE-2026-81869.md): OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation (CVSS 5.1)
- [CVE-2026-81870](https://cve.now/CVE-2026-81870.md): OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs (CVSS 2.0)
- [CVE-2026-55701](https://cve.now/CVE-2026-55701.md): OpenTelemetry githubreceiver silently ignores configured required\_headers authentication (CVSS 6.9)
- [CVE-2026-47256](https://cve.now/CVE-2026-47256.md): OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token (CVSS 5.3)
- [CVE-2026-47701](https://cve.now/CVE-2026-47701.md): OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth (CVSS 7.7)
- [CVE-2026-48496](https://cve.now/CVE-2026-48496.md): opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent (CVSS 6.2)
- [CVE-2026-81192](https://cve.now/CVE-2026-81192.md): OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS (CVSS 7.0)
- [CVE-2026-45404](https://cve.now/CVE-2026-45404.md): OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access (CVSS 5.9)
- [CVE-2026-48504](https://cve.now/CVE-2026-48504.md): OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation (CVSS 5.3)
- [CVE-2026-59892](https://cve.now/CVE-2026-59892.md): OpenTelemetry JavaScript: Denial of service in \`JaegerPropagator\` via unhandled exception on a malformed header (CVSS 7.5)
- [CVE-2026-54712](https://cve.now/CVE-2026-54712.md): OpenTelemetry Javaagent RMI context propagation allows resource exhaustion (CVSS 5.3)
- [CVE-2026-54704](https://cve.now/CVE-2026-54704.md): OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords (CVSS 6.5)
- [CVE-2026-54285](https://cve.now/CVE-2026-54285.md): opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation (CVSS 5.3)
- [CVE-2026-44967](https://cve.now/CVE-2026-44967.md): opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response (CVSS 5.3)
- [CVE-2026-45287](https://cve.now/CVE-2026-45287.md): OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse (CVSS 2.1)
- [CVE-2026-41178](https://cve.now/CVE-2026-41178.md): OpenTelemetry-Go's baggage parsing no longer caps raw header length (CVSS 5.3)
- [CVE-2026-45686](https://cve.now/CVE-2026-45686.md): OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI (CVSS 7.5)
- [CVE-2026-45685](https://cve.now/CVE-2026-45685.md): OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages (CVSS 7.5)
- [CVE-2026-45684](https://cve.now/CVE-2026-45684.md): OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers (CVSS 4.9)
- [CVE-2026-45683](https://cve.now/CVE-2026-45683.md): OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure (CVSS 3.8)
- [CVE-2026-45681](https://cve.now/CVE-2026-45681.md): OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size (CVSS 5.9)
- [CVE-2026-45680](https://cve.now/CVE-2026-45680.md): OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU (CVSS 5.9)
- [CVE-2026-45679](https://cve.now/CVE-2026-45679.md): OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages (CVSS 6.5)
- [CVE-2026-45678](https://cve.now/CVE-2026-45678.md): OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads (CVSS 7.5)
- [CVE-2026-45676](https://cve.now/CVE-2026-45676.md): OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent (CVSS 5.5)
- [CVE-2026-45682](https://cve.now/CVE-2026-45682.md): OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals (CVSS 5.1)
- [CVE-2026-45292](https://cve.now/CVE-2026-45292.md): opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation (CVSS 5.3)
- [CVE-2026-44902](https://cve.now/CVE-2026-44902.md): opentelemetry-js: Prometheus exporter process crash via malformed HTTP request (CVSS 7.5)
- [CVE-2026-44213](https://cve.now/CVE-2026-44213.md): OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured (CVSS 6.5)
- [CVE-2026-42602](https://cve.now/CVE-2026-42602.md): azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay (CVSS 8.1)
- [CVE-2026-42191](https://cve.now/CVE-2026-42191.md): OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter (CVSS 6.5)
- [CVE-2026-42348](https://cve.now/CVE-2026-42348.md): OpAMP client reads unbounded HTTP response bodies (CVSS 5.9)
- [CVE-2026-41484](https://cve.now/CVE-2026-41484.md): OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body (CVSS 5.3)
- [CVE-2026-41483](https://cve.now/CVE-2026-41483.md): Unbounded HTTP response body read in OpenTelemetry.Resources.Azure (CVSS 5.9)
- [CVE-2026-41310](https://cve.now/CVE-2026-41310.md): OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth (CVSS 5.3)
- [CVE-2026-41433](https://cve.now/CVE-2026-41433.md): OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR (CVSS 8.4)
- [CVE-2026-41173](https://cve.now/CVE-2026-41173.md): Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS (CVSS 5.9)
- [CVE-2026-41078](https://cve.now/CVE-2026-41078.md): OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path (CVSS 5.9)
- [CVE-2026-40894](https://cve.now/CVE-2026-40894.md): OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers (CVSS 5.3)
- [CVE-2026-40891](https://cve.now/CVE-2026-40891.md): OpenTelemetry dotnet: Unbounded \`grpc-status-details-bin\` parsing in OTLP/gRPC retry handling (CVSS 5.3)
- [CVE-2026-40182](https://cve.now/CVE-2026-40182.md): OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies (CVSS 5.3)
- [CVE-2026-39883](https://cve.now/CVE-2026-39883.md): OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking (CVSS 7.3)
- [CVE-2026-39882](https://cve.now/CVE-2026-39882.md): OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies (CVSS 5.3)
- [CVE-2026-29181](https://cve.now/CVE-2026-29181.md): OpenTelemetry-Go multi-value \`baggage\` header extraction causes excessive allocations (remote dos amplification) (CVSS 7.5)
- [CVE-2026-33701](https://cve.now/CVE-2026-33701.md): OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution (CVSS 9.3)
- [CVE-2026-24051](https://cve.now/CVE-2026-24051.md): OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking (CVSS 7.0)
- [CVE-2025-27513](https://cve.now/CVE-2025-27513.md): OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package (CVSS 7.5)
- [CVE-2024-45043](https://cve.now/CVE-2024-45043.md): OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability (CVSS 5.3)
- [CVE-2024-42368](https://cve.now/CVE-2024-42368.md): open-telemetry has an Observable Timing Discrepancy (CVSS 6.5)
- [CVE-2024-36129](https://cve.now/CVE-2024-36129.md): OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC (CVSS 8.2)
- [CVE-2024-32028](https://cve.now/CVE-2024-32028.md): Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore (CVSS 4.1)
- [CVE-2023-47108](https://cve.now/CVE-2023-47108.md): DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics (CVSS 7.5)
- [CVE-2023-45142](https://cve.now/CVE-2023-45142.md): OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics (CVSS 7.5)
- [CVE-2023-43810](https://cve.now/CVE-2023-43810.md): opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics (CVSS 7.5)
- [CVE-2023-39951](https://cve.now/CVE-2023-39951.md): Instrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backend (CVSS 6.5)
- [CVE-2023-25151](https://cve.now/CVE-2023-25151.md): DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/open-telemetry
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.