Medium severity · published Aug 24, 2026
CVE-2026-45404
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
5.9
CVSS
0.1%
EPSS
No
On KEV
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opentelemetry-go · open-telemetry
>= 0.11.0, < 1.45.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-45404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-45404
github.com
https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8
github.com
https://github.com/open-telemetry/opentelemetry-go/pull/8693
github.com
https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0
github.com
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p
More from opentelemetry-go
7.5
CVE-2026-29181
OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)
7.0
CVE-2026-39883
OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking
7.0
CVE-2026-24051
OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
6.3
CVE-2026-81871
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
6.3
CVE-2026-81872
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
