open-telemetry opentelemetry-go
9 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-81871 | < 0.21.0 | OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-81872 | < 0.21.0 | OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-81869 | >= 1.10.0, < 1.33.0 | OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation | MEDIUM 5.1 | 0.2 % | ||
| CVE-2026-81870 | >= 1.5.0, < 1.45.0 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs | LOW 2.0 | 0.3 % | ||
| CVE-2026-45404 | >= 0.11.0, < 1.45.0 | OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access | MEDIUM 5.9 | 0.1 % | ||
| CVE-2026-39883 | >= 1.15.0, < 1.43.0 | OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking | HIGH 7.3 | 0.3 % | ||
| CVE-2026-39882 | < 1.43.0 | OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-29181 | >= 1.36.0, < 1.41.0 | OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) | HIGH 7.5 | 0.8 % | ||
| CVE-2026-24051 | >= 1.21.0, < 1.40.0 | OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking | HIGH 7.0 | 0.2 % |