CVE-2026-45287

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions prior to 0.0.17

Description The go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 modules leak one file descriptor on each successful ParseFile() call. This occurs because ParseFile() opens the schema file and passes it to the Parse() function without closing it. In long-running processes, repeated parsing can exhaust the process file descriptor limit, leading to a denial of service. This issue is exploitable if a consuming application exposes repeated schema parsing to a path controlled by an attacker.

Recommendations Update to version 0.0.17.