CVE-2026-45404

What it is

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.

At a glance

Exploitability

Can be exploited locally on the machine without logging in. High risk of service disruption.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-24 22:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-12 15:10 UTC Last updatedMost recent change to the record

Details

Published

2026-08-24 22:16 UTC

Last modified

2026-10-12 15:10 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-362 · Race condition

Record status

Deferred

Attack profile CVSS 4.0 · 5.9

Attack vector

Local

Complexity

Low

Attack requirements

Present

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High