OP
Vendor
open-telemetry
58
CVEs
0
On KEV
3
New 30D
Products
OP6.3
opentelemetry-python
open-telemetry
2 CVEs0 on KEV2 new
OP5.8
opentelemetry-js-contrib
open-telemetry
1 CVEs0 on KEV1 new
OP8.4
opentelemetry-ebpf-instrumentation
open-telemetry
11 CVEs0 on KEV0 new
OP7.5
opentelemetry-go
open-telemetry
8 CVEs0 on KEV0 new
OP7.8
opentelemetry-dotnet
open-telemetry
6 CVEs0 on KEV0 new
OP7.5
opentelemetry-dotnet-contrib
open-telemetry
6 CVEs0 on KEV0 new
OP8.1
opentelemetry-collector-contrib
open-telemetry
3 CVEs0 on KEV0 new
OP9.8
opentelemetry-java-instrumentation
open-telemetry
3 CVEs0 on KEV0 new
OP7.5
opentelemetry-js
open-telemetry
3 CVEs0 on KEV0 new
GI5.3
github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter
open-telemetry
1 CVEs0 on KEV0 new
GI6.9
github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver
open-telemetry
1 CVEs0 on KEV0 new
GO5.3
go.opentelemetry.io/otel/baggage
open-telemetry
1 CVEs0 on KEV0 new
GO5.3
go.opentelemetry.io/otel/propagation
open-telemetry
1 CVEs0 on KEV0 new
GO5.5
go.opentelemetry.io/otel/schema/v1.0
open-telemetry
1 CVEs0 on KEV0 new
GO5.5
go.opentelemetry.io/otel/schema/v1.1
open-telemetry
1 CVEs0 on KEV0 new
OP5.3
OpenTelemetry.Api
open-telemetry
1 CVEs0 on KEV0 new
OP5.3
opentelemetry-cpp
open-telemetry
1 CVEs0 on KEV0 new
OP6.2
opentelemetry-ebpf-profiler
open-telemetry
1 CVEs0 on KEV0 new
OP5.9
OpenTelemetry.Exporter.Jaeger
open-telemetry
1 CVEs0 on KEV0 new
OP5.3
OpenTelemetry.Exporter.OpenTelemetryProtocol
open-telemetry
1 CVEs0 on KEV0 new
OP5.3
OpenTelemetry.Extensions.Propagators
open-telemetry
1 CVEs0 on KEV0 new
OP5.3
opentelemetry-java
open-telemetry
1 CVEs0 on KEV0 new
OP7.7
opentelemetry-operator
open-telemetry
1 CVEs0 on KEV0 new
OP5.3
opentelemetry-rust
open-telemetry
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116694 New | OP opentelemetry-python open-telemetry | 6.3 | Oct 27 | OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation |
| CVE-2026-114603 New | OP opentelemetry-python open-telemetry | 5.3 | Oct 22 | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api |
| CVE-2026-104872 | OP opentelemetry-js-contrib open-telemetry | 5.8 | Oct 2 | Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute |
| CVE-2026-81871 | OP opentelemetry-go open-telemetry | 6.3 | Sep 16 | OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning |
| CVE-2026-81872 | OP opentelemetry-go open-telemetry | 6.3 | Sep 16 | OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full |
| CVE-2026-81869 | OP opentelemetry-go open-telemetry | 5.1 | Sep 16 | OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation |
| CVE-2026-81870 | OP opentelemetry-go open-telemetry | 2.0 | Sep 16 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
| CVE-2026-55701 | GI github.com/open-telemetry/opentelemetry-collector-contrib/receiver/githubreceiver open-telemetry | 6.9 | Sep 15 | OpenTelemetry githubreceiver silently ignores configured required_headers authentication |
| CVE-2026-47256 | GI github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter open-telemetry | 5.3 | Sep 14 | OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token |
| CVE-2026-47701 | OP opentelemetry-operator open-telemetry | 7.7 | Sep 14 | OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth |
| CVE-2026-48496 | OP opentelemetry-ebpf-profiler open-telemetry | 6.2 | Sep 11 | opentelemetry-ebpf-profiler: Unprivileged process can trigger a denial of service on the ebpf-profiler agent |
| CVE-2026-81192 | OP opentelemetry-dotnet-contrib open-telemetry | 7.0 | Sep 8 | OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS |
| CVE-2026-45404 | OP opentelemetry-go open-telemetry | 5.9 | Aug 24 | OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access |
| CVE-2026-48504 | OP opentelemetry-rust open-telemetry | 5.3 | Jul 17 | OpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagation |
| CVE-2026-59892 | OP opentelemetry-js open-telemetry | 7.5 | Jul 8 | OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header |
| CVE-2026-54712 | OP opentelemetry-java-instrumentation open-telemetry | 7.5 | Jul 1 | OpenTelemetry Javaagent RMI context propagation allows resource exhaustion |
| CVE-2026-54704 | OP opentelemetry-java-instrumentation open-telemetry | 6.5 | Jul 1 | OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords |
| CVE-2026-54285 | OP opentelemetry-js open-telemetry | 5.3 | Jun 22 | opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation |
| CVE-2026-44967 | OP opentelemetry-cpp open-telemetry | 5.3 | Jun 12 | opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response |
| CVE-2026-45287 | GO go.opentelemetry.io/otel/schema/v1.1 open-telemetry | 5.5 | Jun 4 | OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse |
| CVE-2026-41178 | GO go.opentelemetry.io/otel/baggage open-telemetry | 5.3 | Jun 4 | OpenTelemetry-Go's baggage parsing no longer caps raw header length |
| CVE-2026-45686 | OP opentelemetry-ebpf-instrumentation open-telemetry | 7.5 | Jun 2 | OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI |
| CVE-2026-45685 | OP opentelemetry-ebpf-instrumentation open-telemetry | 7.5 | Jun 2 | OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages |
| CVE-2026-45684 | OP opentelemetry-ebpf-instrumentation open-telemetry | 5.3 | Jun 2 | OpenTelemetry eBPF Instrumentation: Log enricher writev path can overread and overwrite user buffers |
| CVE-2026-45683 | OP opentelemetry-ebpf-instrumentation open-telemetry | 3.8 | Jun 2 | OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure |
| CVE-2026-45681 | OP opentelemetry-ebpf-instrumentation open-telemetry | 5.9 | Jun 2 | OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size |
| CVE-2026-45680 | OP opentelemetry-ebpf-instrumentation open-telemetry | 7.5 | Jun 2 | OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU |
| CVE-2026-45679 | OP opentelemetry-ebpf-instrumentation open-telemetry | 6.5 | Jun 2 | OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages |
| CVE-2026-45678 | OP opentelemetry-ebpf-instrumentation open-telemetry | 7.5 | Jun 2 | OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads |
| CVE-2026-45676 | OP opentelemetry-ebpf-instrumentation open-telemetry | 5.5 | Jun 2 | OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent |
| CVE-2026-45682 | OP opentelemetry-ebpf-instrumentation open-telemetry | 5.5 | Jun 2 | OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals |
| CVE-2026-45292 | OP opentelemetry-java open-telemetry | 5.3 | May 28 | opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation |
| CVE-2026-44902 | OP opentelemetry-js open-telemetry | 7.5 | May 27 | opentelemetry-js: Prometheus exporter process crash via malformed HTTP request |
| CVE-2026-44213 | OP opentelemetry-dotnet-contrib open-telemetry | 6.5 | May 26 | OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured |
| CVE-2026-42602 | OP opentelemetry-collector-contrib open-telemetry | 8.1 | May 13 | azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay |
| CVE-2026-42191 | OP opentelemetry-dotnet open-telemetry | 7.8 | May 12 | OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter |
| CVE-2026-42348 | OP opentelemetry-dotnet-contrib open-telemetry | 7.5 | May 12 | OpAMP client reads unbounded HTTP response bodies |
| CVE-2026-41484 | OP opentelemetry-dotnet-contrib open-telemetry | 5.9 | May 6 | OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body |
| CVE-2026-41483 | OP opentelemetry-dotnet-contrib open-telemetry | 5.9 | May 6 | Unbounded HTTP response body read in OpenTelemetry.Resources.Azure |
| CVE-2026-41310 | OP opentelemetry-dotnet open-telemetry | 5.3 | May 6 | OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth |
| CVE-2026-41433 | OP opentelemetry-ebpf-instrumentation open-telemetry | 8.4 | Apr 24 | OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR |
| CVE-2026-41173 | OP opentelemetry-dotnet-contrib open-telemetry | 5.9 | Apr 23 | Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS |
| CVE-2026-41078 | OP OpenTelemetry.Exporter.Jaeger open-telemetry | 5.9 | Apr 23 | OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path |
| CVE-2026-40894 | OP OpenTelemetry.Api open-telemetry | 5.3 | Apr 23 | OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers |
| CVE-2026-40891 | OP opentelemetry-dotnet open-telemetry | 5.3 | Apr 23 | OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling |
| CVE-2026-40182 | OP opentelemetry-dotnet open-telemetry | 5.9 | Apr 23 | OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies |
| CVE-2026-39883 | OP opentelemetry-go open-telemetry | 7.0 | Apr 8 | OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking |
| CVE-2026-39882 | OP opentelemetry-go open-telemetry | 5.3 | Apr 8 | OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies |
| CVE-2026-29181 | OP opentelemetry-go open-telemetry | 7.5 | Apr 7 | OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) |
| CVE-2026-33701 | OP opentelemetry-java-instrumentation open-telemetry | 9.8 | Mar 27 | OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution |