Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
CVE-2026-59892
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header 08 Jul
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-54285
  • github.com/open-telemetry/opentelemetry-js
 opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation 22 Jun
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-44967
  • github.com/open-telemetry/opentelemetry-cpp
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response 12 Jun
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-41178
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry-Go's baggage parsing no longer caps raw header length 04 Jun
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-44902
  • github.com/open-telemetry/opentelemetry-js
 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request 27 May
  • Fix available
  • Severity - 7.5 (High)
CVE-2026-41078
  • github.com/open-telemetry/opentelemetry-cpp
  • github.com/open-telemetry/opentelemetry-dotnet
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path 23 Apr
  • Fix available
  • Severity - 5.9 (Medium)
CVE-2026-40182
  • github.com/open-telemetry/opentelemetry-dotnet
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies 23 Apr
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-39883
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking 08 Apr
  • Fix available
  • Severity - 7.3 (High)
CVE-2026-39882
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies 08 Apr
  • Fix available
  • Severity - 5.3 (Medium)
CVE-2026-24051
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking 02 Feb
  • Fix available
  • Severity - 7.0 (High)
CVE-2023-47108
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics 10 Nov 2023
  • Fix available
  • Severity - 7.5 (High)
CVE-2023-45142
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics 12 Oct 2023
  • Fix available
  • Severity - 7.5 (High)
CVE-2023-43810
  • github.com/open-telemetry/opentelemetry-go
  • github.com/open-telemetry/opentelemetry-go-contrib
  • github.com/open-telemetry/opentelemetry-js
  • github.com/open-telemetry/opentelemetry-python-contrib
 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics 06 Oct 2023
  • Fix available
  • Severity - 7.5 (High)