OpenTelemetry-Go versions before 0.0.17 in the go.opentelemetry.io/otel/schema/v1.0 and v1.1 packages contain a resource leak vulnerability (CWE-772). The ParseFile function opens a schema file but fails to close the file descriptor after parsing, leaking one file descriptor per call. In long-running processes that repeatedly parse schemas, this can exhaust the process's file descriptor limit, leading to denial of service. Exploitation requires an application to expose repeated schema parsing to attacker-controlled input. The vulnerability is fixed in version 0.0.17.

The vulnerability can cause denial of service by exhausting file descriptors in a process that repeatedly calls ParseFile. This resource exhaustion could disrupt normal operation of applications using the affected OpenTelemetry-Go packages. There is no indication of privilege escalation or data compromise. Exploitation depends on the application exposing repeated schema parsing to attacker-controlled paths.

Upgrade to OpenTelemetry-Go version 0.0.17 or later, where this resource leak has been fixed. No other mitigation or workaround is indicated. Patch status is confirmed by the vendor stating version 0.0.17 contains the fix.