CVE-2026-45287

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45287

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45287.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-45287

Aliases

Downstream

CLEANSTART (3)

DEBIAN (1)

DEBIAN-CVE-2026-45287

MINI (6)

openSUSE (1)

openSUSE-SU-2026:21483-1

RHSA (10)

UBUNTU (1)

UBUNTU-CVE-2026-45287

Related

openSUSE-SU-2026:21483-1

Published

2026-06-04T14:45:54Z

Modified

2026-10-16T02:59:44Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse

Details

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-772",
        "CWE-775"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45287.json"
}

References

Affected packages

Git / github.com/open-telemetry/opentelemetry-go

Affected ranges

Type

GIT

Repo

https://github.com/open-telemetry/opentelemetry-go

Events

Introduced

Fixed

b62d92831b2dd142f5a0cc89c828270274196877

Fixed

e72a235518cb773137efd80336a179028bc34684

Fixed

f12d198f161b61735d65705248715aa97021ba8d

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:opentelemetry:telemetry_schema_files:*:*:*:*:*:go:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.0.17"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "e72a235518cb773137efd80336a179028bc34684"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "f12d198f161b61735d65705248715aa97021ba8d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

bridge/opencensus/examples/bridge/v0.*

bridge/opencensus/examples/bridge/v0.14.0

bridge/opencensus/test/v0.*

bridge/opencensus/test/v0.23.0

bridge/opencensus/test/v0.24.0

bridge/opencensus/v0.*

bridge/opencensus/v0.14.0

bridge/opencensus/v0.15.0

bridge/opencensus/v0.16.0

bridge/opencensus/v0.17.0

bridge/opencensus/v0.18.0

bridge/opencensus/v0.19.0

bridge/opencensus/v0.20.0

bridge/opencensus/v0.21.0

bridge/opencensus/v0.23.0

bridge/opencensus/v0.24.0

bridge/opentracing/v0.*

bridge/opentracing/v0.11.0

bridge/opentracing/v0.12.0

bridge/opentracing/v0.13.0

bridge/opentracing/v0.14.0

bridge/opentracing/v0.15.0

bridge/opentracing/v0.16.0

bridge/opentracing/v0.17.0

bridge/opentracing/v0.18.0

bridge/opentracing/v0.19.0

bridge/opentracing/v0.20.0

bridge/opentracing/v0.21.0

bridge/opentracing/v1.*

bridge/opentracing/v1.0.0

bridge/opentracing/v1.0.0-RC2

bridge/opentracing/v1.0.0-RC3

bridge/opentracing/v1.0.1

example/basic/v0.*

example/basic/v0.10.0

example/basic/v0.11.0

example/basic/v0.12.0

example/basic/v0.13.0

example/basic/v0.14.0

example/basic/v0.15.0

example/basic/v0.2.1

example/basic/v0.2.3

example/basic/v0.3.0

example/basic/v0.4.0

example/basic/v0.4.1

example/basic/v0.4.2

example/basic/v0.4.3

example/basic/v0.6.0

example/basic/v0.7.0

example/basic/v0.8.0

example/basic/v0.9.0

example/fib/v1.*

example/fib/v1.0.0

example/fib/v1.0.0-RC3

example/fib/v1.0.1

example/grpc/v0.*

example/grpc/v0.10.0

example/grpc/v0.2.1

example/grpc/v0.2.3

example/grpc/v0.3.0

example/grpc/v0.4.0

example/grpc/v0.4.1

example/grpc/v0.4.2

example/grpc/v0.4.3

example/grpc/v0.6.0

example/grpc/v0.7.0

example/grpc/v0.8.0

example/grpc/v0.9.0

example/http-stackdriver/v0.*

example/http-stackdriver/v0.2.1

example/http-stackdriver/v0.2.3

example/http/v0.*

example/http/v0.10.0

example/http/v0.2.1

example/http/v0.2.3

example/http/v0.3.0

example/http/v0.4.0

example/http/v0.4.1

example/http/v0.4.2

example/http/v0.4.3

example/http/v0.6.0

example/http/v0.7.0

example/http/v0.8.0

example/http/v0.9.0

example/jaeger/v0.*

example/jaeger/v0.10.0

example/jaeger/v0.11.0

example/jaeger/v0.12.0

example/jaeger/v0.13.0

example/jaeger/v0.14.0

example/jaeger/v0.15.0

example/jaeger/v0.16.0

example/jaeger/v0.17.0

example/jaeger/v0.18.0

example/jaeger/v0.19.0

example/jaeger/v0.2.1

example/jaeger/v0.2.3

example/jaeger/v0.20.0

example/jaeger/v0.3.0

example/jaeger/v0.4.0

example/jaeger/v0.4.1

example/jaeger/v0.4.2

example/jaeger/v0.4.3

example/jaeger/v0.6.0

example/jaeger/v0.7.0

example/jaeger/v0.8.0

example/jaeger/v0.9.0

example/jaeger/v1.*

example/jaeger/v1.0.0

example/jaeger/v1.0.0-RC1

example/jaeger/v1.0.0-RC2

example/jaeger/v1.0.0-RC3

example/jaeger/v1.0.1

example/namedtracer/v0.*

example/namedtracer/v0.10.0

example/namedtracer/v0.11.0

example/namedtracer/v0.12.0

example/namedtracer/v0.13.0

example/namedtracer/v0.14.0

example/namedtracer/v0.15.0

example/namedtracer/v0.16.0

example/namedtracer/v0.17.0

example/namedtracer/v0.18.0

example/namedtracer/v0.19.0

example/namedtracer/v0.2.1

example/namedtracer/v0.2.3

example/namedtracer/v0.20.0

example/namedtracer/v0.3.0

example/namedtracer/v0.4.0

example/namedtracer/v0.4.1

example/namedtracer/v0.4.2

example/namedtracer/v0.4.3

example/namedtracer/v0.6.0

example/namedtracer/v0.7.0

example/namedtracer/v0.8.0

example/namedtracer/v0.9.0

example/namedtracer/v1.*

example/namedtracer/v1.0.0

example/namedtracer/v1.0.0-RC1

example/namedtracer/v1.0.0-RC2

example/namedtracer/v1.0.0-RC3

example/namedtracer/v1.0.1

example/opencensus/v0.*

example/opencensus/v0.15.0

example/opencensus/v0.16.0

example/opencensus/v0.17.0

example/opencensus/v0.18.0

example/opencensus/v0.19.0

example/opencensus/v0.20.0

example/opencensus/v0.21.0

example/opencensus/v0.23.0

example/opencensus/v0.24.0

example/otel-collector/v0.*

example/otel-collector/v0.10.0

example/otel-collector/v0.11.0

example/otel-collector/v0.12.0

example/otel-collector/v0.13.0

example/otel-collector/v0.14.0

example/otel-collector/v0.15.0

example/otel-collector/v0.16.0

example/otel-collector/v0.17.0

example/otel-collector/v0.18.0

example/otel-collector/v0.19.0

example/otel-collector/v0.20.0

example/otel-collector/v0.6.0

example/otel-collector/v0.7.0

example/otel-collector/v0.8.0

example/otel-collector/v0.9.0

example/otel-collector/v1.*

example/otel-collector/v1.0.0

example/otel-collector/v1.0.0-RC1

example/otel-collector/v1.0.0-RC2

example/otel-collector/v1.0.0-RC3

example/otel-collector/v1.0.1

example/passthrough/v1.*

example/passthrough/v1.0.0

example/passthrough/v1.0.0-RC1

example/passthrough/v1.0.0-RC2

example/passthrough/v1.0.0-RC3

example/passthrough/v1.0.1

example/prom-collector/v0.*

example/prom-collector/v0.16.0

example/prom-collector/v0.17.0

example/prom-collector/v0.18.0

example/prom-collector/v0.19.0

example/prom-collector/v0.20.0

example/prometheus/v0.*

example/prometheus/v0.10.0

example/prometheus/v0.11.0

example/prometheus/v0.12.0

example/prometheus/v0.13.0

example/prometheus/v0.14.0

example/prometheus/v0.15.0

example/prometheus/v0.16.0

example/prometheus/v0.17.0

example/prometheus/v0.18.0

example/prometheus/v0.19.0

example/prometheus/v0.2.1

example/prometheus/v0.2.3

example/prometheus/v0.20.0

example/prometheus/v0.21.0

example/prometheus/v0.22.0

example/prometheus/v0.23.0

example/prometheus/v0.24.0

example/prometheus/v0.3.0

example/prometheus/v0.4.0

example/prometheus/v0.4.1

example/prometheus/v0.4.2

example/prometheus/v0.4.3

example/prometheus/v0.6.0

example/prometheus/v0.7.0

example/prometheus/v0.8.0

example/prometheus/v0.9.0

example/zipkin/v0.*

example/zipkin/v0.10.0

example/zipkin/v0.11.0

example/zipkin/v0.12.0

example/zipkin/v0.13.0

example/zipkin/v0.14.0

example/zipkin/v0.15.0

example/zipkin/v0.16.0

example/zipkin/v0.17.0

example/zipkin/v0.18.0

example/zipkin/v0.19.0

example/zipkin/v0.20.0

example/zipkin/v0.3.0

example/zipkin/v0.4.0

example/zipkin/v0.4.1

example/zipkin/v0.4.2

example/zipkin/v0.4.3

example/zipkin/v0.6.0

example/zipkin/v0.7.0

example/zipkin/v0.8.0

example/zipkin/v0.9.0

example/zipkin/v1.*

example/zipkin/v1.0.0

example/zipkin/v1.0.0-RC1

example/zipkin/v1.0.0-RC2

example/zipkin/v1.0.0-RC3

example/zipkin/v1.0.1

exporter/metric/prometheus/v0.*

exporter/metric/prometheus/v0.2.0

exporter/metric/prometheus/v0.2.1

exporter/trace/jaeger/v0.*

exporter/trace/jaeger/v0.1.1

exporter/trace/jaeger/v0.1.2

exporter/trace/jaeger/v0.2.0

exporter/trace/jaeger/v0.2.1

exporter/trace/stackdriver/v0.*

exporter/trace/stackdriver/v0.1.1

exporter/trace/stackdriver/v0.1.2

exporter/trace/stackdriver/v0.2.0

exporter/trace/stackdriver/v0.2.1

exporter/trace/stdout/v0.*

exporter/trace/stdout/v0.1.1

exporter/trace/stdout/v0.1.2

exporters/jaeger/v1.*

exporters/jaeger/v1.0.0

exporters/jaeger/v1.0.0-RC1

exporters/jaeger/v1.0.0-RC2

exporters/jaeger/v1.0.0-RC3

exporters/jaeger/v1.0.1

exporters/metric/prometheus/v0.*

exporters/metric/prometheus/v0.10.0

exporters/metric/prometheus/v0.11.0

exporters/metric/prometheus/v0.12.0

exporters/metric/prometheus/v0.13.0

exporters/metric/prometheus/v0.14.0

exporters/metric/prometheus/v0.15.0

exporters/metric/prometheus/v0.16.0

exporters/metric/prometheus/v0.17.0

exporters/metric/prometheus/v0.18.0

exporters/metric/prometheus/v0.19.0

exporters/metric/prometheus/v0.2.3

exporters/metric/prometheus/v0.20.0

exporters/metric/prometheus/v0.21.0

exporters/metric/prometheus/v0.3.0

exporters/metric/prometheus/v0.4.0

exporters/metric/prometheus/v0.4.1

exporters/metric/prometheus/v0.4.2

exporters/metric/prometheus/v0.4.3

exporters/metric/prometheus/v0.6.0

exporters/metric/prometheus/v0.7.0

exporters/metric/prometheus/v0.8.0

exporters/metric/prometheus/v0.9.0

exporters/otlp/otlpmetric/otlpmetricgrpc/v0.*

exporters/otlp/otlpmetric/otlpmetricgrpc/v0.21.0

exporters/otlp/otlpmetric/otlpmetricgrpc/v0.22.0

exporters/otlp/otlpmetric/otlpmetricgrpc/v0.23.0

exporters/otlp/otlpmetric/otlpmetricgrpc/v0.24.0

exporters/otlp/otlpmetric/otlpmetrichttp/v0.*

exporters/otlp/otlpmetric/otlpmetrichttp/v0.22.0

exporters/otlp/otlpmetric/otlpmetrichttp/v0.23.0

exporters/otlp/otlpmetric/otlpmetrichttp/v0.24.0

exporters/otlp/otlpmetric/v0.*

exporters/otlp/otlpmetric/v0.21.0

exporters/otlp/otlpmetric/v0.22.0

exporters/otlp/otlpmetric/v0.23.0

exporters/otlp/otlpmetric/v0.24.0

exporters/otlp/otlptrace/otlptracegrpc/v1.*

exporters/otlp/otlptrace/otlptracegrpc/v1.0.0

exporters/otlp/otlptrace/otlptracegrpc/v1.0.0-RC1

exporters/otlp/otlptrace/otlptracegrpc/v1.0.0-RC2

exporters/otlp/otlptrace/otlptracegrpc/v1.0.0-RC3

exporters/otlp/otlptrace/otlptracegrpc/v1.0.1

exporters/otlp/otlptrace/otlptracehttp/v1.*

exporters/otlp/otlptrace/otlptracehttp/v1.0.0

exporters/otlp/otlptrace/otlptracehttp/v1.0.0-RC1

exporters/otlp/otlptrace/otlptracehttp/v1.0.0-RC2

exporters/otlp/otlptrace/otlptracehttp/v1.0.0-RC3

exporters/otlp/otlptrace/otlptracehttp/v1.0.1

exporters/otlp/otlptrace/v1.*

exporters/otlp/otlptrace/v1.0.0

exporters/otlp/otlptrace/v1.0.0-RC1

exporters/otlp/otlptrace/v1.0.0-RC2

exporters/otlp/otlptrace/v1.0.0-RC3

exporters/otlp/otlptrace/v1.0.1

exporters/otlp/v0.*

exporters/otlp/v0.10.0

exporters/otlp/v0.11.0

exporters/otlp/v0.12.0

exporters/otlp/v0.13.0

exporters/otlp/v0.14.0

exporters/otlp/v0.15.0

exporters/otlp/v0.16.0

exporters/otlp/v0.17.0

exporters/otlp/v0.18.0

exporters/otlp/v0.19.0

exporters/otlp/v0.20.0

exporters/otlp/v0.3.0

exporters/otlp/v0.4.0

exporters/otlp/v0.4.1

exporters/otlp/v0.4.2

exporters/otlp/v0.4.3

exporters/otlp/v0.6.0

exporters/otlp/v0.7.0

exporters/otlp/v0.8.0

exporters/otlp/v0.9.0

exporters/prometheus/v0.*

exporters/prometheus/v0.21.0

exporters/prometheus/v0.22.0

exporters/prometheus/v0.23.0

exporters/prometheus/v0.24.0

exporters/stdout/stdoutmetric/v0.*

exporters/stdout/stdoutmetric/v0.21.0

exporters/stdout/stdoutmetric/v0.22.0

exporters/stdout/stdoutmetric/v0.23.0

exporters/stdout/stdoutmetric/v0.24.0

exporters/stdout/stdouttrace/v1.*

exporters/stdout/stdouttrace/v1.0.0

exporters/stdout/stdouttrace/v1.0.0-RC1

exporters/stdout/stdouttrace/v1.0.0-RC2

exporters/stdout/stdouttrace/v1.0.0-RC3

exporters/stdout/stdouttrace/v1.0.1

exporters/stdout/v0.*

exporters/stdout/v0.10.0

exporters/stdout/v0.11.0

exporters/stdout/v0.12.0

exporters/stdout/v0.13.0

exporters/stdout/v0.14.0

exporters/stdout/v0.15.0

exporters/stdout/v0.16.0

exporters/stdout/v0.17.0

exporters/stdout/v0.18.0

exporters/stdout/v0.19.0

exporters/stdout/v0.20.0

exporters/trace/jaeger/v0.*

exporters/trace/jaeger/v0.10.0

exporters/trace/jaeger/v0.11.0

exporters/trace/jaeger/v0.12.0

exporters/trace/jaeger/v0.13.0

exporters/trace/jaeger/v0.14.0

exporters/trace/jaeger/v0.15.0

exporters/trace/jaeger/v0.16.0

exporters/trace/jaeger/v0.17.0

exporters/trace/jaeger/v0.18.0

exporters/trace/jaeger/v0.19.0

exporters/trace/jaeger/v0.2.3

exporters/trace/jaeger/v0.20.0

exporters/trace/jaeger/v0.3.0

exporters/trace/jaeger/v0.4.0

exporters/trace/jaeger/v0.4.1

exporters/trace/jaeger/v0.4.2

exporters/trace/jaeger/v0.4.3

exporters/trace/jaeger/v0.6.0

exporters/trace/jaeger/v0.7.0

exporters/trace/jaeger/v0.8.0

exporters/trace/jaeger/v0.9.0

exporters/trace/jaeger/v1.*

exporters/trace/jaeger/v1.0.0-RC1

exporters/trace/stackdriver/v0.*

exporters/trace/stackdriver/v0.2.3

exporters/trace/zipkin/v0.*

exporters/trace/zipkin/v0.10.0

exporters/trace/zipkin/v0.11.0

exporters/trace/zipkin/v0.12.0

exporters/trace/zipkin/v0.13.0

exporters/trace/zipkin/v0.14.0

exporters/trace/zipkin/v0.15.0

exporters/trace/zipkin/v0.16.0

exporters/trace/zipkin/v0.17.0

exporters/trace/zipkin/v0.18.0

exporters/trace/zipkin/v0.19.0

exporters/trace/zipkin/v0.20.0

exporters/trace/zipkin/v0.3.0

exporters/trace/zipkin/v0.4.0

exporters/trace/zipkin/v0.4.1

exporters/trace/zipkin/v0.4.2

exporters/trace/zipkin/v0.4.3

exporters/trace/zipkin/v0.6.0

exporters/trace/zipkin/v0.7.0

exporters/trace/zipkin/v0.8.0

exporters/trace/zipkin/v0.9.0

exporters/trace/zipkin/v1.*

exporters/trace/zipkin/v1.0.0-RC1

exporters/zipkin/v1.*

exporters/zipkin/v1.0.0

exporters/zipkin/v1.0.0-RC1

exporters/zipkin/v1.0.0-RC2

exporters/zipkin/v1.0.0-RC3

exporters/zipkin/v1.0.1

internal/metric/v0.*

internal/metric/v0.21.0

internal/metric/v0.22.0

internal/metric/v0.23.0

internal/metric/v0.24.0

metric/v0.*

metric/v0.17.0

metric/v0.18.0

metric/v0.19.0

metric/v0.20.0

metric/v0.21.0

metric/v0.22.0

metric/v0.23.0

metric/v0.24.0

oteltest/v0.*

oteltest/v0.17.0

oteltest/v0.18.0

oteltest/v0.19.0

oteltest/v0.20.0

oteltest/v1.*

oteltest/v1.0.0-RC1

oteltest/v1.0.0-RC2

oteltest/v1.0.0-RC3

sdk/export/metric/v0.*

sdk/export/metric/v0.17.0

sdk/export/metric/v0.18.0

sdk/export/metric/v0.19.0

sdk/export/metric/v0.20.0

sdk/export/metric/v0.21.0

sdk/export/metric/v0.22.0

sdk/export/metric/v0.23.0

sdk/export/metric/v0.24.0

sdk/metric/v0.*

sdk/metric/v0.17.0

sdk/metric/v0.18.0

sdk/metric/v0.19.0

sdk/metric/v0.20.0

sdk/metric/v0.21.0

sdk/metric/v0.22.0

sdk/metric/v0.23.0

sdk/metric/v0.24.0

sdk/v0.*

sdk/v0.10.0

sdk/v0.11.0

sdk/v0.12.0

sdk/v0.13.0

sdk/v0.14.0

sdk/v0.15.0

sdk/v0.16.0

sdk/v0.17.0

sdk/v0.18.0

sdk/v0.19.0

sdk/v0.20.0

sdk/v1.*

sdk/v1.0.0

sdk/v1.0.0-RC1

sdk/v1.0.0-RC2

sdk/v1.0.0-RC3

sdk/v1.0.1

tools/v0.*

tools/v0.2.3

trace/v0.*

trace/v0.17.0

trace/v0.18.0

trace/v0.19.0

trace/v0.20.0

trace/v1.*

trace/v1.0.0

trace/v1.0.0-RC1

trace/v1.0.0-RC2

trace/v1.0.0-RC3

trace/v1.0.1

v0.*

v0.1.1

v0.1.2

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.15.0

v0.16.0

v0.17.0

v0.18.0

v0.19.0

v0.2.0

v0.2.1

v0.2.1.1

v0.2.2

v0.2.3

v0.20.0

v0.3.0

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.6.0

v0.7.0

v0.8.0

v0.9.0

v1.*

v1.0.0

v1.0.0-RC1

v1.0.0-RC2

v1.0.0-RC3

v1.0.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45287.json"