CVE-2026-45404

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Published Aug 24, 2026 CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.

Analysis

Technical impact

The vulnerability involves an unsynchronized baggage map in OpenTelemetry‑Go’s OpenTracing bridge. When concurrent SetBaggageItem and correlation.MapFromContext calls access the same map, Go’s map concurrency rules are violated, causing a panic that terminates the process. The primary impact is a denial of service, as the application or service using the library crashes. The weakness is a race condition (CWE‑362) and improper synchronization (CWE‑667).

Affected Systems

OpenTelemetry-Go version 0.11.0 through 1.44.0 is affected. The issue appears in the library that implements the OpenTracing bridge. Any application that links to this library and uses the OpenTracing bridge for baggage handling can be impacted.

Risk and Exploitability

The CVSS score of 5.9 signals moderate severity; the EPSS score of < 1% indicates a very low but non-zero likelihood of exploitation. The vulnerability is not in CISA’s KEV catalog, implying no widespread attacks currently reported. The attack vector is inferred to be application‑level concurrent tracing operations; an attacker would need to trigger simultaneous SetBaggageItem and MapFromContext calls on the same span to cause the crash.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

open-telemetry

opentelemetry-go

affected

Version	Status	Constraints
`>= 0.11.0, < 1.45.0`	affected	—

No data.

Vendor Product Versions

Opentelemetry

Opentelemetry-go

Version	Status	Scheme	Platform
`[0.11.0,1.45.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to OpenTelemetry‑Go v1.45.0 or newer where the unsynchronized map bug has been fixed.
If an upgrade cannot be applied immediately, serialize SetBaggageItem and correlation.MapFromContext calls on each span, or guard the span with a mutex to prevent simultaneous access.
Alternatively, disable the OpenTracing bridge or avoid using baggage features that rely on the shared map if the workload does not need them.

Generated by OpenCVE AI on September 1, 2026 at 18:51 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-42cj-99w8-cp2p	OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.139% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8
https://github.com/open-telemetry/opentelemetry-go/pull/8693
https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p
https://nvd.nist.gov/vuln/detail/CVE-2026-45404
https://www.cve.org/CVERecord?id=CVE-2026-45404

History

Sep 1, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-820
References		https://nvd.nist.gov/vuln/detail/CVE-2026-45404 https://www.cve.org/CVERecord?id=CVE-2026-45404
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.2, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Aug 27, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 24, 2026 11:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Opentelemetry Opentelemetry opentelemetry-go
Vendors & Products		Opentelemetry Opentelemetry opentelemetry-go

Aug 24, 2026 9:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
Title		OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Weaknesses		CWE-362 CWE-667
References		https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8 https://github.com/open-telemetry/opentelemetry-go/pull/8693 https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0 https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p
Metrics		cvssV4_0 `{'score': 5.9, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Opentelemetry Opentelemetry-go

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-667
Improper Locking
CWE-820
Missing Synchronization