CVE-2026-45404 - Vulnerability Details

- OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.

Published: 2026-08-24

Score: 5.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability involves an unsynchronized baggage map in OpenTelemetry‑Go’s OpenTracing bridge. When concurrent SetBaggageItem and correlation.MapFromContext calls access the same map, Go’s map concurrency rules are violated, causing a panic that terminates the process. The primary impact is a denial of service, as the application or service using the library crashes. The weakness is a race condition (CWE‑362) and improper synchronization (CWE‑667).

Affected Systems

OpenTelemetry-Go version 0.11.0 through 1.44.0 is affected. The issue appears in the library that implements the OpenTracing bridge. Any application that links to this library and uses the OpenTracing bridge for baggage handling can be impacted.

Risk and Exploitability

The CVSS score of 5.9 signals moderate severity; the EPSS score of < 1% indicates a very low but non-zero likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog, implying no widespread attacks currently reported. The attack vector is inferred to be application‑level concurrent tracing operations; an attacker would need to trigger simultaneous SetBaggageItem and MapFromContext calls on the same span to cause the crash.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

open-telemetry

opentelemetry-go

affected

Version	Status	Constraints
`>= 0.11.0, < 1.45.0`	affected	—

No data.

Vendor Product Confidence Versions

Opentelemetry

Opentelemetry-go

98%

Version	Status	Scheme	Platform
`[0.11.0,1.45.0)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to OpenTelemetry‑Go v1.45.0 or newer where the unsynchronized map bug has been fixed.
If an upgrade cannot be applied immediately, serialize SetBaggageItem and correlation.MapFromContext calls on each span, or guard the span with a mutex to prevent simultaneous access.
Alternatively, disable the OpenTracing bridge or avoid using baggage features that rely on the shared map if the workload does not need them.

Generated by OpenCVE AI on September 1, 2026 at 18:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-42cj-99w8-cp2p	OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00131.

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8
https://github.com/open-telemetry/opentelemetry-go/pull/8693
https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p
https://nvd.nist.gov/vuln/detail/CVE-2026-45404
https://www.cve.org/CVERecord?id=CVE-2026-45404

History

Tue, 01 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-820
References		https://nvd.nist.gov/vuln/detail/CVE-2026-45404 https://www.cve.org/CVERecord?id=CVE-2026-45404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 27 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 24 Aug 2026 23:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Opentelemetry Opentelemetry opentelemetry-go
Vendors & Products		Opentelemetry Opentelemetry opentelemetry-go

Mon, 24 Aug 2026 21:30:00 +0000

Type	Values Removed	Values Added
Description		OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
Title		OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Weaknesses		CWE-362 CWE-667
References		https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8 https://github.com/open-telemetry/opentelemetry-go/pull/8693 https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0 https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p
Metrics		cvssV4_0 `{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Opentelemetry Opentelemetry-go

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-08-24T21:19:00.617Z

Updated: 2026-08-27T14:18:58.878Z

Reserved: 2026-05-12T01:48:40.451Z

Link: CVE-2026-45404

Vulnrichment

Updated: 2026-08-27T14:18:50.415Z

NVD

Status : Deferred

Published: 2026-08-24T22:16:53.020

Modified: 2026-09-09T21:06:39.057

Link: CVE-2026-45404

Redhat

Severity : Moderate

Publid Date: 2026-08-24T21:19:00Z

Links: CVE-2026-45404 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-01T19:00:13Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-667
Improper Locking
CWE-820
Missing Synchronization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object