CVEs we hold for Open-telemetry
Records whose assigning authority named Open-telemetry as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-81872OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullopen-telemetry opentelemetry-go
CVE-2026-81871OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningopen-telemetry opentelemetry-go
CVE-2026-81870OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsopen-telemetry opentelemetry-go
CVE-2026-81869OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationopen-telemetry opentelemetry-go
CVE-2026-81192OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOSopen-telemetry opentelemetry-dotnet-contrib
CVE-2026-59892OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed headeropen-telemetry opentelemetry-js
CVE-2026-55701OpenTelemetry githubreceiver silently ignores configured required_headers authenticationopen-telemetry github.com/open-telemetry/opentelemetry-colle…
CVE-2026-54712OpenTelemetry Javaagent RMI context propagation allows resource exhaustionopen-telemetry opentelemetry-java-instrumentation
CVE-2026-54704OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwordsopen-telemetry opentelemetry-java-instrumentation
CVE-2026-54285opentelemetry-js: Unbounded memory allocation in W3C Baggage propagationopen-telemetry opentelemetry-js
CVE-2026-48504OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagationopen-telemetry opentelemetry-rust
CVE-2026-48496opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agentopen-telemetry opentelemetry-ebpf-profiler
CVE-2026-47701OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authopen-telemetry opentelemetry-operator
CVE-2026-47256OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API…open-telemetry github.com/open-telemetry/opentelemetry-colle…
CVE-2026-45686OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBIopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45685OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messagesopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45684OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffersopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45683OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosureopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45682OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removalsopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45681OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45680OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPUopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45679OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messagesopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45678OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45676OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agentopen-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-45404OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent accessopen-telemetry opentelemetry-go
CVE-2026-45292opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagationopen-telemetry opentelemetry-java; io.opentelemetry…
CVE-2026-45287OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parseopen-telemetry go.opentelemetry.io/otel/schema/v1.0
CVE-2026-44967opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP responseopen-telemetry opentelemetry-cpp
CVE-2026-44902opentelemetry-js: Prometheus exporter process crash via malformed HTTP requestopen-telemetry opentelemetry-js; @opentelemetry…
CVE-2026-44213OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configuredopen-telemetry opentelemetry-dotnet-contrib
CVE-2026-42602azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replayopen-telemetry opentelemetry-collector-contrib
CVE-2026-42348OpAMP client reads unbounded HTTP response bodiesopen-telemetry opentelemetry-dotnet-contrib
CVE-2026-42191OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP…open-telemetry opentelemetry-dotnet
CVE-2026-41484OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response bodyopen-telemetry opentelemetry-dotnet-contrib
CVE-2026-41483Unbounded HTTP response body read in OpenTelemetry.Resources.Azureopen-telemetry opentelemetry-dotnet-contrib
CVE-2026-41433OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted…open-telemetry opentelemetry-ebpf-instrumentation
CVE-2026-41310OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growthopen-telemetry opentelemetry-dotnet
CVE-2026-41178OpenTelemetry-Go's baggage parsing no longer caps raw header lengthopen-telemetry go.opentelemetry.io/otel/propagation
CVE-2026-41173Unbounded HTTP response body read in OpenTelemetry.Sampler.AWSopen-telemetry opentelemetry-dotnet-contrib
CVE-2026-41078OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion pathopen-telemetry OpenTelemetry.Exporter.Jaeger
CVE-2026-40894OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersopen-telemetry OpenTelemetry.Extensions.Propagators
CVE-2026-40891OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handlingopen-telemetry OpenTelemetry.Exporter.OpenTelemetryProtocol
CVE-2026-40182OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesopen-telemetry opentelemetry-dotnet
CVE-2026-39883OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH…open-telemetry opentelemetry-go
CVE-2026-39882OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodiesopen-telemetry opentelemetry-go
CVE-2026-33701OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Executionopen-telemetry opentelemetry-java-instrumentation
CVE-2026-29181OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)open-telemetry opentelemetry-go
CVE-2026-24051OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijackingopen-telemetry opentelemetry-go
CVE-2025-27513OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Packageopen-telemetry opentelemetry-dotnet
CVE-2024-45043OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerabilityopen-telemetry opentelemetry-collector-contrib
CVE-2024-42368open-telemetry has an Observable Timing Discrepancyopen-telemetry opentelemetry-collector-contrib
CVE-2024-36129OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPCopen-telemetry opentelemetry-collector
CVE-2024-32028Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreopen-telemetry opentelemetry-dotnet
CVE-2023-47108DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsopen-telemetry opentelemetry-go-contrib
CVE-2023-45142OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metricsopen-telemetry opentelemetry-go-contrib
CVE-2023-43810opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metricsopen-telemetry opentelemetry-python-contrib
CVE-2023-39951Instrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing…open-telemetry opentelemetry-java-instrumentation
CVE-2023-25151DoS vulnerability for high cardinality metrics in opentelemetry-go-contribopen-telemetry opentelemetry-go-contrib
58 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.