CVE-2026-45287 PUBLISHED

OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

Assigner: GitHub_M
Reserved: 11.05.2026 Published: 04.06.2026 Updated: 04.06.2026

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score: 2.1

Product Status

Vendor open-telemetry
Product go.opentelemetry.io/otel/schema/v1.1
Versions
  • Version < 0.0.17 is affected
Vendor open-telemetry
Product go.opentelemetry.io/otel/schema/v1.0
Versions
  • Version < 0.0.17 is affected

References

Problem Types

  • CWE-772: Missing Release of Resource after Effective Lifetime CWE
  • CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime CWE