A resource exhaustion vulnerability exists in opentelemetry-python prior to version 1.45.1. The TraceState.from_header function parses W3C tracestate headers using an unbounded optional-whitespace regular expression, which can cause excessive CPU usage when processing a malformed header with a long sequence of spaces or tabs. This can impact availability by consuming excessive CPU resources, potentially delaying or blocking other requests in synchronous or asynchronous environments. The vulnerability does not expose or modify telemetry data and does not allow code execution. The issue is fixed in version 1.45.1.
OpenTelemetry JavaScript Contrib instrumentation libraries prior to specified versions include the database connection username in telemetry data as the db.user span attribute by default. This sensitive information is logged and sent to observability backends without requiring opt-in, potentially exposing service topology, roles, environment details, and account naming patterns. The issue is addressed in versions 0.66.0, 0.65.0, 0.67.0, 0.46.0, 0.73.0, and 0.40.0 of the respective packages.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but newGRPCDialOptions does not apply cfg.tlsCfg when creating gRPC transport credentials. The environment-only TLS path instead uses credentials.NewTLS with system roots and no configured client certificate, bypassing intended private CA pinning and mutual TLS unless the application also supplies WithTLSCredentials. A network attacker able to intercept or spoof the collector connection with a system-trusted certificate can read or alter log telemetry. This issue is fixed in version 0.21.0.
CVE-2026-81872 is a medium severity availability vulnerability in the open-telemetry opentelemetry-go SDK. The BatchingProcessor in sdk/log can enter a tight CPU loop when the asynchronous export buffer is full and the exporter is backpressured. This causes repeated immediate export retries, leading to CPU exhaustion and denial of service in the affected application. The issue affects versions prior to 0.21.0. No official patch or fix status is provided in the input data.
CVE-2026-81869 is a medium severity vulnerability in the OpenTelemetry Go SDK trace package that allows bypass of the configured attribute value length limit for string attributes containing the Unicode replacement character U+FFFD. This flaw causes oversized attacker-controlled attribute values to be stored untruncated, weakening memory and denial-of-service protections. The vulnerability requires deployments with attribute value length limits enabled and attacker-controlled data recorded into span attributes. There is no indication of confidentiality or integrity impact.
OpenTelemetry-Go versions from 1.5.0 up to but not including 1.45.0 emit an internal Info-level diagnostic event that logs detailed configuration information including span processor, exporter, and client settings. When applications enable OpenTelemetry internal Info logging via otel.SetLogger, sensitive information such as OTLP gRPC and HTTP collector endpoints, the OTLP HTTP Insecure flag, and full Zipkin collector URLs (which may contain credentials or tokens) can be exposed in logs. The default logger does not emit this event, and authentication headers, TLS keys, and span payloads are not logged. This vulnerability is fixed in version 1.45.0.
The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/trace_receiver.go handleReq() does not check those headers on incoming webhook requests. An unauthenticated sender can therefore bypass an operator's required_headers authentication control and submit arbitrary webhook payloads. When the Secret field is empty, github.ValidatePayload also skips HMAC validation, leaving the webhook endpoint without either configured authentication mechanism. Successful exploitation can inject fabricated CI/CD trace data into the observability pipeline. This issue is fixed in version 0.151.0.
OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource attribute in exporter/sentryexporter/sentry_exporter.go through extractProjectSlug and getOrCreateProjectEndpoint, passes the raw project slug to GetOTLPEndpoints and GetProjectKeys in exporter/sentryexporter/sentry_client.go, and interpolates it into a Sentry API URL without applying projectSlugRegexp through validateRoutingConfig at runtime in exporter/sentryexporter/config.go. Special characters can turn the expected path suffix into query data in all deployments or introduce slash and dot segments that traverse paths when the Sentry deployment normalizes them, while the Collector attaches its operator-configured bearer token to the request. A successful request can reach token-authorized administrative, organization, member, or key endpoints within the configured Sentry organization, and an attacker-controlled project slug can redirect subsequently exported telemetry. Sentry token middleware prevents cross-organization access. This issue is fixed in version 0.154.0.
OpenTelemetry eBPF Profiler is a production-scale agent for profiling applications across multiple programming languages. Starting in version 0.0.202527 and prior to version 0.0.202622, an unprivileged process can cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service. Version 0.0.202622 contains a patch. No known workarounds are available.
An untrusted search path vulnerability exists in the OpenTelemetry.Resources.Host NuGet package for macOS hosts prior to version 1.16.0-beta.2. The vulnerability arises because the host.id resource attribute detector launches the 'sh' and 'ioreg' executables by bare name, relying on the PATH environment variable for resolution. A local attacker with lower privileges who can manipulate the PATH or write to a directory earlier in the PATH can execute arbitrary binaries in the application's security context, leading to local code execution or privilege escalation. This issue affects only macOS hosts; Linux and Windows are not impacted. The vulnerability is patched in version 1.16.0-beta.2. No known workarounds are available.
CVE-2026-45404 is a race condition vulnerability in the OpenTelemetry-Go library affecting versions from 0.11.0 up to but not including 1.45.0. The issue arises from an unsynchronized map used in the OpenTracing bridge's bridgeSpan, which can cause concurrent read/write operations leading to a runtime panic. This can terminate the process and cause a denial of service. The vulnerability is fixed in version 1.45.0.
OpenTelemetry Rust is the Rust OpenTelemetry implementation. In 0.32.0 and earlier, BaggagePropagator::extract_with_context in opentelemetry_sdk did not enforce W3C Baggage size limits before parsing an inbound baggage header, so a large attacker-controlled header could cause unnecessary CPU work and short-lived heap allocations while parsing entries later discarded by the SDK's baggage storage limits. Services that accept untrusted inbound propagation headers may experience increased per-request resource usage when processing oversized baggage headers. This issue is fixed in version 0.32.1.
OpenTelemetry JavaScript versions prior to 2.9.0 contain a vulnerability in the @opentelemetry/propagator-jaeger module where malformed percent-encoded HTTP header values cause an uncaught URIError. This error can terminate a Node.js process using JaegerPropagator as the active propagator. The issue is fixed in version 2.9.0.
CVE-2026-54712 is a medium severity vulnerability in OpenTelemetry Java Instrumentation versions prior to 2.27.0. It involves uncontrolled resource consumption due to the RMI context propagation payload reader not limiting the aggregate size of strings read from the stream. An attacker able to reach an RMI endpoint on an instrumented JVM with RMI instrumentation enabled can send an oversized payload, causing excessive memory allocation and potential denial of service. This issue is fixed in version 2.27.0.
OpenTelemetry Java Instrumentation versions prior to 2.28.0 contain a vulnerability where the JDBC auto-instrumentation fails to sanitize passwords in SQL CONNECT statements if the password is double-quoted. This results in clear-text database passwords being included in trace span attributes and potentially exported to observability backends. The issue is fixed in version 2.28.0.
opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0.
OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From version 0.7.0 to before version 0.9.0, a remotely reachable integer overflow in OBI's memcached text protocol parser can crash the OBI process and cause denial of service. When parsing memcached storage commands such as set, add, replace, append, prepend, or cas, OBI accepts extremely large <bytes> values and adds the payload delimiter length without checking for overflow. A crafted request with <bytes> set to math.MaxInt or math.MaxInt-1 causes the computed payload length to wrap negative and triggers a runtime panic in LargeBufferReader.Peek. This issue has been patched in version 0.9.0.