Vulnerability · Published Aug 24, 2026 · Assigned by GitHub_M
CVE-2026-45404OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Medium 5.9
In plain English
A medium-severity race condition in opentelemetry-go from open-telemetry. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | golang-opentelemetry-otel | no fix listed | DEBIAN-CVE-2026-45404 |
| Debian:13 | golang-opentelemetry-otel | no fix listed | DEBIAN-CVE-2026-45404 |
| Debian:14 | golang-opentelemetry-otel | no fix listed | DEBIAN-CVE-2026-45404 |
| Go | go.opentelemetry.io/otel/bridge/opentracing | 1.45.0 | GHSA-42cj-99w8-cp2p |
| Go | go.opentelemetry.io/otel/bridge/opentracing | 1.45.0 | GO-2026-6258 |
| Ubuntu:22.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-45404 |
| Ubuntu:24.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-45404 |
| Ubuntu:26.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-45404 |
| Ubuntu:26.10 | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-45404 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | opentelemetry-go | >= 0.11.0, < 1.45.0 |
Weakness: CWE-362, CWE-667 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p x_refsource_CONFIRM
- https://github.com/open-telemetry/opentelemetry-go/pull/8693 x_refsource_MISC
- https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8 x_refsource_MISC
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0 x_refsource_MISC