CVE-2026-45287

golang-opentelemetry-otel: OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-45287 is fixed in 20 products on 1 platform, first by DEBIAN-CVE-2026-45287, released June 4, 2026. It is not reported as exploited. Patch Radar priority: Routine.

Routine
CVSS
5.5
medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0017
6th percentile

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Where it's fixed

ProductFixed inFixReleased
Linux
alertmanager · Fedora 43 0.33.0-1.fc43 FEDORA-2026-1AD4561F49 Jun 12, 2026
alertmanager-debuginfo · Fedora 43 0.33.0-1.fc43 FEDORA-2026-1AD4561F49 Jun 12, 2026
alertmanager-debugsource · Fedora 43 0.33.0-1.fc43 FEDORA-2026-1AD4561F49 Jun 12, 2026
golang-opentelemetry-otel · Debian 14 1.46.0-2 DEBIAN-CVE-2026-45287 Jun 4, 2026
google-osconfig-agent · Fedora 43 20260717.00-1.fc43 FEDORA-2026-4A2D23B470 Jul 17, 2026
google-osconfig-agent-debuginfo · Fedora 43 20260717.00-1.fc43 FEDORA-2026-4A2D23B470 Jul 17, 2026
google-osconfig-agent-debugsource · Fedora 43 20260717.00-1.fc43 FEDORA-2026-4A2D23B470 Jul 17, 2026
govulncheck-vulndb · opensuse-leap 16.0 0.0.20260723T184607-160000.1.1 OPENSUSE-SU-2026:21483-1 Jul 30, 2026
nuclei · Fedora 43 3.11.0-1.fc43 FEDORA-2026-D36CA2DD19 Jul 13, 2026
nuclei-debuginfo · Fedora 43 3.11.0-1.fc43 FEDORA-2026-D36CA2DD19 Jul 13, 2026
nuclei-debugsource · Fedora 43 3.11.0-1.fc43 FEDORA-2026-D36CA2DD19 Jul 13, 2026
podman-tui · Fedora 43 1.11.3-1.fc43 FEDORA-2026-1842AAEA5D Jun 28, 2026
podman-tui-debuginfo · Fedora 43 1.11.3-1.fc43 FEDORA-2026-1842AAEA5D Jun 28, 2026
podman-tui-debugsource · Fedora 43 1.11.3-1.fc43 FEDORA-2026-1842AAEA5D Jun 28, 2026
prometheus-podman-exporter · Fedora 43 1.21.2-1.fc43 FEDORA-2026-A96D4EE174 Jun 28, 2026
prometheus-podman-exporter-debuginfo · Fedora 43 1.21.2-1.fc43 FEDORA-2026-A96D4EE174 Jun 28, 2026
prometheus-podman-exporter-debugsource · Fedora 43 1.21.2-1.fc43 FEDORA-2026-A96D4EE174 Jun 28, 2026
rclone · Fedora 43 1.74.3-1.fc43 FEDORA-2026-E1D1B349CD Jun 23, 2026
rclone-debuginfo · Fedora 43 1.74.3-1.fc43 FEDORA-2026-E1D1B349CD Jun 23, 2026
rclone-debugsource · Fedora 43 1.74.3-1.fc43 FEDORA-2026-E1D1B349CD Jun 23, 2026

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.