CVE-2026-45287 Details
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.
A file descriptor leak vulnerability has been identified in OpenTelemetry-Go, specifically in the schema modules v1.0 and v1.1, prior to version 0.0.17. The issue arises in the `ParseFile` function, which opens a schema file and passes it to the `Parse` function without closing the file. This oversight can lead to exhaustion of the process's file descriptor limit, causing a denial-of-service condition. The vulnerability can be exploited if an application repeatedly parses schema files from an attacker-controlled path.
Users can upgrade to OpenTelemetry-Go version 0.0.17 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-772 | Missing Release of Resource after Effective Lifetime | [email protected] |
| CWE-775 | Missing Release of File Descriptor or Handle after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry telemetry schema files | < 0.0.17 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 18, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 4, 2026 | New CVE Received | [email protected] |