Technical impact
OpenTelemetry-Go's schema parser leaks a file descriptor on every successful ParseFile call because the file is never closed after passing it to Parse. Each leak consumes a descriptor from the process. If a long‑running application repeatedly parses schemas, the process can hit the file‑descriptor limit and any subsequent operations that require descriptors will fail, effectively causing a denial of service. The vulnerability is a low‑severity issue but can be impactful in high‑traffic or long‑running deployments.
Affected Systems
The affected components are the OpenTelemetry Go libraries open‑telemetry:go.opentelemetry.io/otel/schema/v1.0 and open‑telemetry:go.opentelemetry.io/otel/schema/v1.1. Any version prior to 0.0.17 of these modules is vulnerable. Users of applications that include these packages without upgrading to the patched release are at risk.
Risk and Exploitability
The CVSS score of 2.1 reflects the low severity of this issue. No EPSS data is available, but the limited attack surface means exploitation would require an attacker-controlled path to the schema parsing logic in a long‑running Go process. The vulnerability is not listed in the CISA KEV catalog, indicating no publicly known active exploitation. Nevertheless, the risk is present in environments where schema files are parsed frequently, as denial of service can be achieved simply by exhausting the file‑descriptor limit.
Github GHSA