Bug 2523159 (CVE-2026-45404) - CVE-2026-45404 go.opentelemetry.io/otel/bridge/opentracing: OpenTelemetry-Go: Denial of Service via unsynchronized baggage map
Summary: CVE-2026-45404 go.opentelemetry.io/otel/bridge/opentracing: OpenTelemetry-Go:...
Keywords:
Status: NEW
Alias: CVE-2026-45404
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2526291
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-24 21:31 UTC by OSIDB Bzimport
Modified: 2026-08-31 13:29 UTC (History)
17 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-24 21:31:18 UTC
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.


Note You need to log in before you can comment on or make changes to this bug.