Medium severityNVD Advisory· Published Aug 24, 2026· Updated Sep 9, 2026
CVE-2026-45404
CVE-2026-45404
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
go.opentelemetry.io/otel/bridge/opentracingGo | >= 0.11.0, < 1.45.0 | 1.45.0 |
Affected products
15- osv-coords14 versionspkg:apk/chainguard/thanos-fipspkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/cortex-fipspkg:apk/chainguard/cortexpkg:apk/chainguard/cortex-geomys-fipspkg:apk/chainguard/thanospkg:apk/wolfi/cortexpkg:apk/chainguard/tempo-2.8pkg:apk/wolfi/pulumi-language-yamlpkg:apk/wolfi/thanospkg:apk/chainguard/pulumi-language-yamlpkg:apk/chainguard/tempo-fips-2.8pkg:apk/chainguard/thanos-receive-controllerpkg:apk/chainguard/thanos-receive-controller-fips
< 0.42.4-r2+ 13 more
- (no CPE)range: < 0.42.4-r2
- (no CPE)range: < 0.0.20260827T195228-160000.1.1
- (no CPE)range: < 1.21.1-r10
- (no CPE)range: < 1.21.1-r11
- (no CPE)range: < 1.21.1-r4
- (no CPE)range: < 0.42.4-r4
- (no CPE)range: < 1.21.1-r11
- (no CPE)range: < 2.8.4-r16
- (no CPE)range: < 1.38.3-r3
- (no CPE)range: < 0.42.4-r4
- (no CPE)range: < 1.38.3-r3
- (no CPE)range: < 2.8.4-r8
- (no CPE)range: < 0_git20260812-r5
- (no CPE)range: < 0_git20260812-r3
- Range: 0.11.0 - 1.44.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-42cj-99w8-cp2pghsaADVISORY
- github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8nvdWEB
- github.com/open-telemetry/opentelemetry-go/pull/8693nvdWEB
- github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0nvdWEB
- github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2pnvdWEB
News mentions
0No linked articles in our index yet.