CVE-2026-45404— OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Quick assessment
Affected
open-telemetry opentelemetry-go
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenTelemetry-Go 是 OpenTelemetry 的 Go 语言实现。从版本 0.11.0 到 1.44.0，OpenTracing 桥接组件中的 bridgeSpan 包含一个未同步的 extraBaggageItems 映射（map），这可能导致程序崩溃。由于 Go 语言中的映射（map）类型不支持并发读写，当对同一个被钩子（hooked）桥接的 bridgeSpan 并发调用 SetBaggageItem 和 correlation.MapFromContext 时，可能触发致命的运行时错误（
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-45404
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
Source: CVE Program / CVE List V5
Vulnerability Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| open-telemetry | opentelemetry-go | >= 0.11.0, < 1.45.0 | - |
|
II. Public POCs for CVE-2026-45404
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45404
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45404 (1)
Vendor Advisories for CVE-2026-45404 (1)
IV. Related Vulnerabilities
Same product: opentelemetry-go
-
CVE-2026-39883
OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: B -
CVE-2026-39882
OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP res -
CVE-2026-29181
OpenTelemetry-Go multi-value `baggage` header extraction cau -
CVE-2026-24051
OpenTelemetry-Go Affected by Arbitrary Code Execution via PA
Same vendor: open-telemetry
-
CVE-2026-48504
OpenTelemetry Rust: Unbounded memory allocation in W3C Bagga -
CVE-2026-59892
OpenTelemetry JavaScript: Denial of service in `JaegerPropag -
CVE-2026-54712
OpenTelemetry Javaagent RMI context propagation allows resou -
CVE-2026-54704
OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentatio -
CVE-2026-54285
opentelemetry-js: Unbounded memory allocation in W3C Baggage
Same weakness: CWE-362
-
CVE-2026-77638
Tor <0.4.9.11中间人竞争条件漏洞 -
CVE-2025-62300
HCL IntelliOps Event Management is affected by multiple secu -
CVE-2026-76393
Race Condition during Model Upload through the REST API in S -
CVE-2026-62727
Windows Telephony Service Elevation of Privilege Vulnerabili -
CVE-2026-45742
Gotenberg: Concurrent Execution using Shared Resource with I
V. Comments for CVE-2026-45404
No comments yet