[ Vendor · 4 CVEs ]
open-telemetry
CVEs affecting open-telemetry published in the last 30 days, plus any open-telemetry CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114603 | 22 Oct 2026 | CVSS 5.3 | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiOpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_header in… | Fix |
| CVE-2026-104872 | 2 Oct 2026 | CVSS 5.8 | Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attributeOpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0… | Fix |
| CVE-2026-81872 | 16 Sep 2026 | CVSS 6.3 | OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullOpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter… | Fix |
| CVE-2026-81869 | 16 Sep 2026 | CVSS 5.1 | OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncationOpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can… | Fix |