CVE-2026-45287 OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse
Repeated schema parsing leaks file descriptors, potentially causing denial of service in long-running Go applications using OpenTelemetry.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45287?
CVE-2026-45287 is a low-severity denial of service vulnerability in open-telemetry go.opentelemetry.io/otel/schema/v1.0, published on 4 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.
Which versions are affected by CVE-2026-45287?
7 open source packages ship an affected version, including go.opentelemetry.io/otel/schema/v1.0, go.opentelemetry.io/otel/schema and go.opentelemetry.io/otel/schema/v1.1. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
go.opentelemetry.io/otel/schema/v1.0 Go | All versions | 0.0.17 |
go.opentelemetry.io/otel/schema/v1.0 Go | All versions | 0.0.17 |
go.opentelemetry.io/otel/schema Go | All versions | 0.0.17 |
go.opentelemetry.io/otel/schema Go | All versions | 0.0.17 |
go.opentelemetry.io/otel/schema Go | All versions | 0.0.17 |
go.opentelemetry.io/otel/schema/v1.1 Go | All versions | 0.0.17 |
1 more packages
go.opentelemetry.io/otel/schema/v1.1 Go | All versions | 0.0.17 |
Linux distribution packages (14)
buildah Red Hat:hummingbird:1 | All versions | 0:1.44.0-1.hum1 |
buildah-tests Red Hat:hummingbird:1 | All versions | 0:1.44.0-1.hum1 |
caddy Red Hat:hummingbird:1 | All versions | 0:2.11.4-0.1.hum1 |
containers-common Red Hat:hummingbird:1 | All versions | 0:0.67.0-1.1.hum1 |
containers-common-extra Red Hat:hummingbird:1 | All versions | 0:0.67.0-1.1.hum1 |
podman Red Hat:hummingbird:1 | All versions | 0:5.8.2-1.1.hum1 |
podman-docker Red Hat:hummingbird:1 | All versions | 0:5.8.2-1.1.hum1 |
podman-machine Red Hat:hummingbird:1 | All versions | 0:5.8.2-1.1.hum1 |
podman-remote Red Hat:hummingbird:1 | All versions | 0:5.8.2-1.1.hum1 |
podman-tests Red Hat:hummingbird:1 | All versions | 0:5.8.2-1.1.hum1 |
podmansh Red Hat:hummingbird:1 | All versions | 0:5.8.2-1.1.hum1 |
skopeo Red Hat:hummingbird:1 | All versions | 0:1.23.0-1.hum1 |
skopeo-tests Red Hat:hummingbird:1 | All versions | 0:1.23.0-1.hum1 |
syft Red Hat:hummingbird:1 | All versions | 0:1.45.1-0.1.hum1 |
Products include Opentelemetry Telemetry Schema Files.
How do I fix CVE-2026-45287?
Upgrade go.opentelemetry.io/otel/schema/v1.0 to 0.0.17 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-45287 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-45287 exists.
Sources
Also known as CLEANSTART-2026-LK11440, CLEANSTART-2026-NI63338, CLEANSTART-2026-YI22158, DEBIAN-CVE-2026-45287, ECHO-7401-d539-595c, GHSA-995v-fvrw-c78m and 14 more.