OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| open-telemetry | go.opentelemetry.io/otel/schema/v1.1 | affected |
|
||||||
| open-telemetry | go.opentelemetry.io/otel/schema/v1.0 | affected |
|
No data.
| Vendor | Product | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Opentelemetry | Opentelemetry-go |
|
| Source | ID | Title |
|---|---|---|
Github GHSA |
GHSA-995v-fvrw-c78m | opentelemetry-go's Schema ParseFile leaks file descriptors on each parse |
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.168% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Opentelemetry
Opentelemetry opentelemetry-go |
|
| Vendors & Products |
Opentelemetry
Opentelemetry opentelemetry-go |
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue. | |
| Title | OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse | |
| Weaknesses | CWE-772 CWE-775 |
|
| References |
| |
| Metrics |
cvssV4_0
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Jun 5, 2026, 10:07 AM
Github GHSA