CVE-2026-45404 open-telemetry CVE debrief

Who should care

Defenders responsible for Go applications using OpenTelemetry-Go, particularly those in versions between 0.11.0 and 1.44.0, should assess exposure and prioritize upgrading to version 1.45.0 or later.

Why it matters

A denial-of-service vulnerability exists in OpenTelemetry-Go, the Go implementation of OpenTelemetry, from version 0.11.0 through 1.44.0. The OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic due to concurrent read/write access to Go maps. This issue is fixed in version 1.45.0.

• Potential denial-of-service incidents due to concurrent access issues in the OpenTracing bridge.
• Need to verify exposure in Go applications using vulnerable OpenTelemetry-Go versions.
• Priority to upgrade to version 1.45.0 or later to fix the issue.
• Possible impact on application reliability and availability if not addressed.

Technical summary

The OpenTracing bridge in OpenTelemetry-Go contains an unsynchronized extraBaggageItems map, which can cause a panic due to concurrent read/write access to Go maps. This issue exists in versions 0.11.0 through 1.44.0 and is fixed in version 1.45.0. The vulnerability is caused by the lack of synchronization in the bridgeSpan's extraBaggageItems map, which can lead to a panic when multiple goroutines access the map concurrently. Defenders should prioritize verifying exposure in Go applications using OpenTelemetry-Go versions between 0.11.0 and 1.44.0, and upgrading to version 1.45.0 or later if vulnerable.

Defensive priority

Defenders should prioritize verifying exposure in Go applications using OpenTelemetry-Go versions between 0.11.0 and 1.44.0, and upgrading to version 1.45.0 or later if vulnerable.

Recommended defensive actions

• Verify the version of OpenTelemetry-Go in use and upgrade to version 1.45.0 or later if vulnerable.
• Review Go application configurations to ensure proper synchronization when using the OpenTracing bridge.
• Monitor for potential denial-of-service incidents related to this vulnerability.
• Perform an inventory of assets using OpenTelemetry-Go to identify potential exposure.
• Review and update change management processes to include verification of OpenTelemetry-Go version upgrades.
• Track and document the remediation progress and results for auditing purposes.
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its existence in OpenTelemetry-Go versions 0.11.0 through 1.44.0 and the fix in version 1.45.0. However, specific details about exploitation or victim impact are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.