Skip to content
Fencer Vulns
medium 5.5

CVE-2026-45287 json

OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

published 2026-05-28 5 mo ago modified 2026-07-22 3 mo ago also GHSA-995v-fvrw-c78m , GO-2026-5281 , EUVD-2026-34291

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 6%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Patch / fix

  • go go.opentelemetry.io/otel/schema/v1.1 0.0.17
  • go go.opentelemetry.io/otel/schema/v1.0 0.0.17
  • go go.opentelemetry.io/otel/schema 0.0.17
  • opentelemetry telemetry_schema_files 0.0.17
  • golang-opentelemetry-otel Debian 14 1.46.0-2

debian advisories DEBIAN-CVE-2026-45287

  • containers-common hummingbird 1 0.67.0-1.1.hum1
  • containers-common-extra hummingbird 1 0.67.0-1.1.hum1
  • kubernetes1.35 hummingbird 1 1.35.6-1.hum1
  • kubernetes1.35-client hummingbird 1 1.35.6-1.hum1
  • kubernetes1.35-kubeadm hummingbird 1 1.35.6-1.hum1
  • kubernetes1.35-systemd hummingbird 1 1.35.6-1.hum1
  • caddy hummingbird 1 2.11.4-0.1.hum1
  • syft hummingbird 1 1.45.1-0.1.hum1

red hat advisories RHSA-2026:7420RHSA-2026:25535RHSA-2026:25238RHSA-2026:25137RHSA-2026:24577RHSA-2026:23263

  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:21483-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-45287 updated cvss 4.0

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9, assisted/agent-preinstall-image-builder-rhel9 Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-waiters-rhel9, openshift-builds/openshift-builds-webhook-rhel9, openshift-builds/openshift-builds-rhel9-operator, openshift-builds/openshift-builds-controller-rhel9, openshift-builds/openshift-builds-git-cloner-rhel9, openshift-builds/openshift-builds-image-bundler-rhel9, +3 more Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-istio-csr-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Compliance Operator compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9-operator, openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-must-gather-rhel9, openshift-sandboxed-containers/osc-podvm-payload-rhel9, openshift-sandboxed-containers/osc-cloud-api-adaptor-rhel9 Red Hat Cryostat 4 cryostat/cryostat-storage-rhel9, cryostat/cryostat-rhel9-operator, cryostat/cryostat-grafana-dashboard-rhel9
    +34 more products
    Red Hat Dynamic Accelerator Slicer Operator for Red Hat OpenShift dynamic-accelerator-slicer-tech-preview/instaslice-rhel9-operator, dynamic-accelerator-slicer-tech-preview/instaslice-daemonset-rhel9, dynamic-accelerator-slicer-tech-preview/instaslice-scheduler-rhel9 Red Hat Exploit Intelligence exploit-intelligence-tech-preview/agent-client-rhel9, exploit-intelligence-tech-preview/vulnerability-analysis-rhel9, exploit-intelligence-tech-preview/exploit-intelligence-operator-bundle, exploit-intelligence-tech-preview/exploit-intelligence-operator-controller-rhel9 Red Hat External Secrets Operator for Red Hat OpenShift external-secrets-operator/external-secrets-rhel9, external-secrets-operator/bitwarden-sdk-server-rhel9, external-secrets-operator/external-secrets-operator-rhel9, external-secrets-operator/external-secrets-operator-bundle Red Hat ExternalDNS Operator edo/external-dns-rhel9 Red Hat File Integrity Operator compliance/openshift-compliance-openscap-rhel8, compliance/openshift-compliance-rhel8-operator, compliance/openshift-compliance-operator-bundle, compliance/openshift-compliance-must-gather-rhel8, compliance/openshift-file-integrity-rhel8-operator, compliance/openshift-file-integrity-operator-bundle Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9, gatekeeper/gatekeeper-rhel9-operator, gatekeeper/gatekeeper-operator-bundle Red Hat Job Set Tech Preview job-set/jobset-rhel9, job-set/jobset-rhel9-operator, job-set/jobset-operator-bundle Red Hat Kernel Module Management Operator for Red Hat Openshift kmm/kernel-module-management-rhel9-operator, kmm/kernel-module-management-must-gather-rhel9, kmm/kernel-module-management-hub-rhel9-operator, kmm/kernel-module-management-webhook-server-rhel9 Red Hat Kube Descheduler Operator kube-descheduler-operator/descheduler-rhel9, kube-descheduler-operator/kube-descheduler-rhel9-operator, kube-descheduler-operator/kube-descheduler-operator-bundle Red Hat Leader Worker Set leader-worker-set/lws-rhel9, leader-worker-set/lws-rhel9-operator, leader-worker-set/lws-operator-bundle Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator, openshift-logging/lokistack-gateway-rhel9, openshift-logging/cluster-logging-rhel9-operator Red Hat Logical Volume Manager Storage lvms4/topolvm-rhel9, lvms4/lvms-rhel9-operator, lvms4/lvms-operator-bundle, lvms4/lvms-must-gather-rhel9, redhat-user-workloads/logical-volume-manag-tenant/topolvm, redhat-user-workloads/logical-volume-manag-tenant/lvm-operator, +1 more Red Hat Machine Deletion Remediation Operator workload-availability/machine-deletion-remediation-rhel9-operator, workload-availability/machine-deletion-remediation-operator-bundle Red Hat MCP Lifecycle Operator mcp-lifecycle-operator-beta/mcp-lifecycle-rhel9-operator Red Hat MCP Server for Red Hat OpenShift openshift-mcp-beta/openshift-mcp-server-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-cli-rhel9, mta/mta-hub-rhel9, mta/mta-rhel9-operator, mta/mta-analyzer-addon-rhel9, mta/mta-solution-server-rhel9, mta/mta-java-external-provider-rhel9, +3 more Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-controller-rhel8 Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-api-rhel9, mtv-candidate/mtv-rhel9-operator, mtv-candidate/mtv-virt-v2v-rhel9, mtv-candidate/mtv-operator-bundle, mtv-candidate/mtv-ova-proxy-rhel9, mtv-candidate/mtv-controller-rhel9, +12 more Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator, multiarch-tuning/multiarch-tuning-operator-bundle Red Hat Multicluster Engine for Kubernetes multicluster-engine/hive-rhel9, multicluster-engine/work-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/must-gather-rhel9, multicluster-engine/registration-rhel9, multicluster-engine/addon-manager-rhel9, +23 more Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-agent-rhel9, multicluster-globalhub/multicluster-globalhub-grafana-rhel8, multicluster-globalhub/multicluster-globalhub-grafana-rhel9, multicluster-globalhub/multicluster-globalhub-manager-rhel9, multicluster-globalhub/multicluster-globalhub-rhel9-operator, multicluster-globalhub/multicluster-globalhub-kessel-inventory-api-rhel9 Red Hat Network Observability Operator network-observability/network-observability-cli-rhel9, network-observability/network-observability-rhel9-operator, network-observability/network-observability-ebpf-agent-rhel9, network-observability/network-observability-flowlogs-pipeline-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift API for Data Protection oadp/oadp-velero-rhel9, oadp/oadp-rhel9-operator, oadp/oadp-mustgather-rhel9, oadp/oadp-velero-plugin-rhel9, oadp/oadp-velero-plugin-for-csi-rhel9, oadp/oadp-velero-plugin-for-gcp-rhel9, +1 more Red Hat OpenShift Developer Tools and Services helm, ocp-tools-4/jenkins-rhel9, ocp-tools-4/jenkins-agent-base-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-rhel9-operator, openshift-lightspeed/openshift-mcp-server-rhel9 Red Hat OpenShift Pipelines openshift-pipelines-client, openshift-pipelines/pipelines-opc-rhel9, openshift-pipelines/pipelines-cache-rhel9, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-rhel9-operator, +14 more Red Hat OpenShift Run Once Duration Override Operator run-once-duration-override-operator/run-once-duration-override-rhel9, run-once-duration-override-operator/run-once-duration-override-rhel9-operator, run-once-duration-override-operator/run-once-duration-override-operator-bundle Red Hat OpenShift Secondary Scheduler Operator openshift-secondary-scheduler-operator/secondary-scheduler-rhel9-operator, openshift-secondary-scheduler-operator/secondary-scheduler-operator-bundle Red Hat OpenShift Serverless kn-workflow-plugin, openshift-serverless-clients, openshift-serverless-1/kn-client-kn-rhel9, openshift-serverless-1/logic-rhel9-operator, openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, +5 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/pilot-rhel8, openshift-service-mesh/proxyv2-rhel9, openshift-service-mesh/istio-cni-rhel8, openshift-service-mesh/istio-must-gather-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/kiali-rhel9-operator, +2 more Red Hat OpenShift Source-to-Image (S2I) source-to-image/source-to-image-rhel8, source-to-image/source-to-image-rhel9 Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9
    affected: workaround, no fix available “Fix deferred”

39 more affected, 1 more fixed, 2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
5 mo ago

Exploit prediction

0.17% chance of exploitation in the next 30 days, higher than 6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 2.1 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/schema/v1.1
<0.0.17
0.0.17
go go.opentelemetry.io/otel/schema/v1.0
<0.0.17
0.0.17
go go.opentelemetry.io/otel/schema
<0.0.17
0.0.17

Affected products

  • open-telemetry go.opentelemetry.io/otel/schema/v1.1
  • open-telemetry go.opentelemetry.io/otel/schema/v1.0

Classification

Weakness
  • CWE-772 Missing Release of Resource after Effective Lifetime
  • CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.