open-telemetry

Records63All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high23CVSS 7.0–8.9

Exploited now

open-telemetry records in CISA KEV

No open-telemetry vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Opentelemetry 14 records HIGH Ebpf Instrumentation 10 records HIGH Configgrpc 1 record HIGH Confighttp 1 record HIGH Opentelemetry.api 1 record LOW Opentelemetry.exporter.onecollector 1 record LOW Opentelemetry.exporter.opentelemetryprotocol 1 record LOW Opentelemetry.exporter.zipkin 1 record LOW

Records

14 records in Opentelemetry · all components

TI-2026-23298 CVE-2026-29181 · GHSA-mh2q-q3fh-2475

OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

HIGH 72

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00821 Published 2026-04-07 Partial fix · 1.41.0 CWE-770

TI-2023-25448 CVE-2023-47108 · GHSA-8pgv-569h-w5rw

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

HIGH 72

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02026 Published 2023-11-10 Partial fix · 0.46.0 CWE-770

TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835

OpenTelemetry-Go's baggage parsing no longer caps raw header length

MEDIUM 63

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00336 Published 2026-06-04 Partial fix · 1.42.0, 1.44.0 CWE-789

TI-2026-32829 CVE-2026-44967

opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response

MEDIUM 57

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry.

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00206 Published 2026-06-12 Partial fix · 1.27.0 CWE-789

TI-2023-23498 CVE-2023-43810 · GHSA-5rv5-6h4r-h22v

opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

MEDIUM 40

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00845 Published 2023-10-06 Fixed in 0.41b0 CWE-400

TI-2023-24163 CVE-2023-45142 · GHSA-rcjv-mgp8-qvmr

OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

LOW 36

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01614 Published 2023-10-12 Partial fix · 0.44.0 CWE-770

TI-2026-28762 CVE-2026-39883 · GHSA-hfvc-g4fc-pqhx

Untrusted search path in open-telemetry opentelemetry-go

LOW 34

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00262 Published 2026-04-08 Partial fix · 1.43.0 CWE-426

TI-2026-19379 CVE-2026-24051 · GHSA-9h8m-3fm2-qjrq

OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

LOW 32

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00176 Published 2026-02-02 Partial fix · 1.40.0 CWE-426

TI-2026-39185 CVE-2026-54285 · GHSA-8988-4f7v-96qf

opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation

LOW 30

opentelemetry-js is the OpenTelemetry JavaScript Client.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00402 Published 2026-06-22 Fixed in 2.8.0 CWE-770

TI-2026-29550 CVE-2026-40894 · GHSA-g94r-2vxg-569j

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

LOW 30

OpenTelemetry dotnet is a dotnet telemetry framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00458 Published 2026-04-23 Fixed in 1.15.3 CWE-789

TI-2026-29715 CVE-2026-41078 · GHSA-38h3-2333-qx47

OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

LOW 26

OpenTelemetry dotnet is a dotnet telemetry framework.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00222 Published 2026-04-23 No fix listed CWE-770

TI-2026-28996 CVE-2026-40182 · GHSA-q834-8qmm-v933

OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

LOW 26

OpenTelemetry dotnet is a dotnet telemetry framework.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00304 Published 2026-04-23 Fixed in 1.15.2 CWE-789

TI-2026-29547 CVE-2026-40891 · GHSA-mr8r-92fq-pj8p

OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling

LOW 23

OpenTelemetry dotnet is a dotnet telemetry framework.

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00192 Published 2026-04-23 Fixed in 1.15.3 CWE-789

TI-2026-28761 CVE-2026-39882 · GHSA-w8rr-5gcm-pp58

OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies

LOW 23

OpenTelemetry-Go is the Go implementation of OpenTelemetry.

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.00199 Published 2026-04-08 Partial fix · 1.43.0, 0.19.0 CWE-789

Open these records in search →

Critical	1
High	23
Medium	36
Low	3
No CVSS	0