open-telemetry opentelemetry-go

• CVE-2026-81871 Medium 6.3 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning 0.2%
• CVE-2026-81872 Medium 6.3 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full 0.4%
• CVE-2026-81869 Medium 5.1 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation 0.2%
• CVE-2026-81870 Low 2.0 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs 0.3%
• CVE-2026-45404 Medium 5.9 OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access 0.1%
• CVE-2026-39883 High 7.0 OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking 0.3%
• CVE-2026-39882 Medium 5.3 OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies 0.2%
• CVE-2026-29181 High 7.5 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) 0.8%
• CVE-2026-24051 High 7.0 OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking 0.2%