open-telemetry vulnerabilities

CVEs per yearBy the year they were published

1. 20235
2. 20244
3. 20251
4. 202652

Newest CVEs

• CVE-2026-118259

  opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing

  open-telemetry · opentelemetry-java

  Medium5.3
• CVE-2026-116694

  OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation

  open-telemetry · opentelemetry-python

  Medium6.3
• CVE-2026-114603

  OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api

  open-telemetry · opentelemetry-python

  Medium5.3
• CVE-2026-104872

  Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

  open-telemetry · opentelemetry-js-contrib

  Medium5.8
• CVE-2026-81871

  OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

  open-telemetry · opentelemetry-go

  Medium6.3
• CVE-2026-81872

  OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

  open-telemetry · opentelemetry-go

  Medium6.3
• CVE-2026-81869

  OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation

  open-telemetry · opentelemetry-go

  Medium5.1
• CVE-2026-81870

  OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs

  open-telemetry · opentelemetry-go

  Low2.0
• CVE-2026-55701

  OpenTelemetry githubreceiver silently ignores configured required_headers authentication

  open-telemetry · opentelemetry-collector-contrib

  Medium6.9
• CVE-2026-47256

  OpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer token

  open-telemetry · opentelemetry-collector-contrib

  Medium5.3