CVE-2026-45404

Deferred Deferred - Pending Action

OpenTelemetry-Go Concurrent Map Access Vulnerability

Publication date: 2026-08-24

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-09-09

Generated

2026-09-14

AI Q&A

2026-08-25

EPSS Evaluated

2026-09-13

NVD

CVE-2026-45404

Affected Vendors & Products

Vendor	Product	Version / Range
opentelemetry	opentelemetry-go	From 0.11.0 (inc) to 1.44.0 (inc)
opentelemetry	opentelemetry-go	1.45.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

OpenTelemetry-Go versions 0.11.0 through 1.44.0 contain a flaw in the OpenTracing bridge's bridgeSpan. An unsynchronized extraBaggageItems map can cause a panic due to unsafe concurrent read/write access. This leads to fatal runtime errors like concurrent map read/write or iteration/write, terminating the process and causing denial of service.

Detection Guidance

This vulnerability is specific to OpenTelemetry-Go versions 0.11.0 through 1.44.0 and involves a race condition in the OpenTracing bridge. Detection requires checking the installed version of OpenTelemetry-Go and reviewing code for concurrent use of SetBaggageItem and correlation.MapFromContext on the same bridgeSpan.

Impact Analysis

This vulnerability can cause your application to crash unexpectedly, leading to downtime and service disruption. If your application uses OpenTelemetry-Go in the affected versions, concurrent operations on the bridgeSpan may trigger a fatal error, halting the process.

Compliance Impact

This vulnerability causes a denial of service by crashing the process due to concurrent map access in the OpenTelemetry-Go bridgeSpan. While it does not directly affect data confidentiality or integrity, a denial of service could impact system availability, which is a key requirement under regulations like GDPR (Article 32) and HIPAA (Security Rule).

Mitigation Strategies

Upgrade OpenTelemetry-Go to version 1.45.0 or later to fix the unsynchronized map access issue in the OpenTracing bridge.

Hi! I’m here to help you understand CVE-2026-45404. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70