The vulnerability CVE-2026-45287 exists in OpenTelemetry-Go's schema parsing (versions before 0.0.17) where the ParseFile function opens a schema file and passes it to Parse without closing it, causing a file descriptor leak. This resource leak can exhaust file descriptors in long-running processes that repeatedly parse schemas, resulting in denial of service. The flaw is identified as CWE-772 (Missing Release of Resource after Effective Lifetime). Red Hat Hardened Images bundle this library transitively. The vulnerability requires local attacker capability to cause repeated schema parsing on attacker-controlled file paths. Red Hat's advisory does not explicitly mention a released patch but provides guidance to apply updates from Red Hat Hardened Images RPMs. The vulnerability is rated medium severity by Red Hat, with no CVSS score provided. There are no known exploits in the wild. The advisory references Red Hat security advisory RHSA-2026:25137 and related upstream commits that fix the issue by properly closing the file descriptor.

The vulnerability can cause denial of service by exhausting file descriptors in affected Go processes that repeatedly parse schema files without closing them. This can lead to process crashes or stalls due to resource exhaustion. The impact is availability degradation only, with no confidentiality or integrity impact. The exposure is limited to local attackers who can influence schema parsing with attacker-controlled file paths. Many Red Hat services bundle the vulnerable library transitively but do not expose the vulnerable code path, limiting the practical attack surface.

Red Hat has released an update for Red Hat Hardened Images RPMs that includes fixes and enhancements addressing this issue. Users should apply the update as described in Red Hat advisory RHSA-2026:25137 available at https://access.redhat.com/errata/RHSA-2026:25137 and https://images.redhat.com/. Since the vulnerability requires repeated schema parsing of attacker-influenced files, limiting exposure to untrusted schema paths can mitigate risk. No additional mitigations are explicitly recommended by Red Hat. Patch status is not explicitly confirmed in the advisory text; users should monitor Red Hat advisories for updated patch information.