{"cve":"CVE-2026-45404","nvd":{"published":"2026-08-24T22:16:53.020","modified":"2026-10-12T15:10:00.207","status":"Deferred","description":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.","cvss_v4":{"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":5.9},"cvss_v3":null,"cwes":["CWE-362","CWE-667"],"references":["https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8","https://github.com/open-telemetry/opentelemetry-go/pull/8693","https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:17.453294893+00:00"},"epss":{"cve":"CVE-2026-45404","score":0.00139,"percentile":0.03239,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-42cj-99w8-cp2p","url":"https://osv.dev/vulnerability/GHSA-42cj-99w8-cp2p","summary":"OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access","modified":"2026-09-10T03:51:12.925826807Z","packages":[{"ecosystem":"Go","name":"go.opentelemetry.io/otel/bridge/opentracing","purl":"pkg:golang/go.opentelemetry.io/otel/bridge/opentracing","ranges":[">=0.11.0 <1.45.0"],"fixed":["1.45.0"]}]},{"id":"GO-2026-6258","url":"https://osv.dev/vulnerability/GO-2026-6258","summary":"OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access in go.opentelemetry.io/otel/bridge/opentracing","modified":"2026-09-02T22:10:54.390828779Z","packages":[{"ecosystem":"Go","name":"go.opentelemetry.io/otel/bridge/opentracing","purl":"pkg:golang/go.opentelemetry.io/otel/bridge/opentracing","ranges":[">=0.11.0 <1.45.0"],"fixed":["1.45.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}