CVE-2026-45287
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.
How to fix
- opentelemetry telemetry_schema_files0.0.17 or later
- go.opentelemetry.io/otel/schema/v1.10.0.17 or later
- go.opentelemetry.io/otel/schema/v1.00.0.17 or later
- go.opentelemetry.io/otel/schema0.0.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry telemetry_schema_files | v < 0.0.17 | 0.0.17 |
| go.opentelemetry.io/otel/schema/v1.1Go | v < 0.0.17 | 0.0.17 |
| go.opentelemetry.io/otel/schema/v1.0Go | v < 0.0.17 | 0.0.17 |
| go.opentelemetry.io/otel/schemaGo | v < 0.0.17 | 0.0.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.