OP
Product
Opentelemetry
14
CVEs
0
On KEV
7.5
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 8Low 0
Watch
Add Opentelemetry to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-29181 | 7.5 | Apr 7 | OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) Affected: 1.36.0 before 1.41.0 |
| CVE-2023-47108 | 7.5 | Nov 10 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go Affected: before 0.46.0 |
| CVE-2023-45142 | 7.5 | Oct 12 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go Affected: before 0.44.0 |
| CVE-2023-43810 | 7.5 | Oct 6 | OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such… Affected: before 0.41b0 |
| CVE-2026-39883 | 7.0 | Apr 8 | OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking Affected: 1.15.0 before 1.43.0 |
| CVE-2026-24051 | 7.0 | Feb 2 | OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking Affected: 1.21.0 before 1.40.0 |
| CVE-2026-41078 | 5.9 | Apr 23 | OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path Affected: before 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0; 1.6.0 |
| CVE-2026-40182 | 5.9 | Apr 23 | OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies Affected: 1.13.1 before 1.15.2 |
| CVE-2026-54285 | 5.3 | Jun 22 | opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation Affected: before 2.8.0 |
| CVE-2026-44967 | 5.3 | Jun 12 | opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response Affected: before 1.27.0 |
| CVE-2026-41178 | 5.3 | Jun 4 | OpenTelemetry-Go's baggage parsing no longer caps raw header length Affected: before 1.42.0; 1.43.0 |
| CVE-2026-40894 | 5.3 | Apr 23 | OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers Affected: 0.5.0 before 1.15.3 |
| CVE-2026-40891 | 5.3 | Apr 23 | OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling Affected: 1.13.1 before 1.15.3 |
| CVE-2026-39882 | 5.3 | Apr 8 | OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies Affected: before 1.43.0 |
Showing 14
