open-telemetry

Products

Exploited and recent CVEs

• CVE-2026-118259 Medium 5.3 opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing 0.5%
• CVE-2026-116694 Medium 6.3 OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation 0.4%
• CVE-2026-114603 Medium 5.3 OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api 0.5%
• CVE-2026-104872 Medium 5.8 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute 0.2%
• CVE-2026-81871 Medium 6.3 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning 0.2%
• CVE-2026-81872 Medium 6.3 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full 0.4%
• CVE-2026-81869 Medium 5.1 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation 0.2%
• CVE-2026-81870 Low 2.0 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs 0.3%
• CVE-2026-55701 Medium 6.9 OpenTelemetry githubreceiver silently ignores configured required_headers authentication 0.7%
• CVE-2026-55701 Medium 6.9 OpenTelemetry githubreceiver silently ignores configured required_headers authentication 0.7%
• CVE-2026-47256 Medium 5.3 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token 0.4%
• CVE-2026-47256 Medium 5.3 OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token 0.4%
• CVE-2026-47701 High 7.7 OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth 0.5%
• CVE-2026-48496 Medium 6.2 opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent 0.1%
• CVE-2026-81192 High 7.0 OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS 0.2%
• CVE-2026-45404 Medium 5.9 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access 0.1%
• CVE-2026-48504 Medium 5.3 OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation 0.4%
• CVE-2026-59892 High 7.5 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header 0.6%
• CVE-2026-54712 Medium 5.3 OpenTelemetry Javaagent RMI context propagation allows resource exhaustion 0.5%
• CVE-2026-54704 Medium 6.5 OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords 0.4%
• CVE-2026-54285 Medium 5.3 opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation 0.4%
• CVE-2026-44967 Medium 5.3 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response 0.2%
• CVE-2026-45287 Low 2.1 OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse 0.2%
• CVE-2026-45287 Low 2.1 OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse 0.2%
• CVE-2026-41178 Medium 5.3 OpenTelemetry-Go's baggage parsing no longer caps raw header length 0.3%
• CVE-2026-41178 Medium 5.3 OpenTelemetry-Go's baggage parsing no longer caps raw header length 0.3%
• CVE-2026-45686 High 7.5 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI 0.4%
• CVE-2026-45685 High 7.5 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages 0.5%
• CVE-2026-45684 Medium 4.9 OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers 0.2%
• CVE-2026-45683 Low 3.8 OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure 0.2%