PT-2026-80733 · Unknown · Opentelemetry-Go
CVE-2026-45404
·
Published
2026-08-20
·
Updated
2026-09-04
CVSS v4.0
5.9
Medium
| Vector | AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
OpenTelemetry-Go versions 0.11.0 through 1.44.0
Description
The OpenTracing bridge contains an unsynchronized
extraBaggageItems map within the bridgeSpan component. Because Go maps do not support safe concurrent read and write access, simultaneous calls to the SetBaggageItem() function and the correlation.MapFromContext() function on the same hooked bridgeSpan can trigger a fatal runtime error. This race condition can lead to a process crash, resulting in a denial of service.Recommendations
Update OpenTelemetry-Go to version 1.45.0.
Exploit
Fix
DoS
Race Condition
Improper Locking
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Opentelemetry-Go