{"id":"CVE-2026-45287","summary":"OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse","details":"OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.","aliases":["GHSA-995v-fvrw-c78m","GO-2026-5281"],"modified":"2026-10-22T10:35:56.076607474Z","published":"2026-06-04T14:45:54.522Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-772","CWE-775"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45287.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45287.json"},{"type":"ADVISORY","url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45287"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684"},{"type":"FIX","url":"https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open-telemetry/opentelemetry-go","events":[{"introduced":"0"},{"fixed":"b62d92831b2dd142f5a0cc89c828270274196877"},{"fixed":"e72a235518cb773137efd80336a179028bc34684"},{"fixed":"f12d198f161b61735d65705248715aa97021ba8d"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:opentelemetry:telemetry_schema_files:*:*:*:*:*:go:*:*","range":[{"introduced":"0"},{"fixed":"0.0.17"}],"source":"CPE_RANGE"},{"range":[{"fixed":"e72a235518cb773137efd80336a179028bc34684"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"f12d198f161b61735d65705248715aa97021ba8d"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v0.20.0","trace/v0.20.0","sdk/v0.20.0","sdk/metric/v0.20.0","sdk/export/metric/v0.20.0","oteltest/v0.20.0","metric/v0.20.0","exporters/trace/zipkin/v0.20.0","exporters/trace/jaeger/v0.20.0","exporters/stdout/v0.20.0","exporters/otlp/v0.20.0","exporters/metric/prometheus/v0.20.0","example/zipkin/v0.20.0","example/prometheus/v0.20.0","example/prom-collector/v0.20.0","example/otel-collector/v0.20.0","example/opencensus/v0.20.0","example/namedtracer/v0.20.0","example/jaeger/v0.20.0","bridge/opentracing/v0.20.0","bridge/opencensus/v0.20.0","v1.0.1","trace/v1.0.1","sdk/v1.0.1","sdk/metric/v0.24.0","sdk/export/metric/v0.24.0","metric/v0.24.0","internal/metric/v0.24.0","exporters/zipkin/v1.0.1","exporters/stdout/stdouttrace/v1.0.1","exporters/stdout/stdoutmetric/v0.24.0","exporters/prometheus/v0.24.0","exporters/otlp/otlptrace/v1.0.1","exporters/otlp/otlptrace/otlptracehttp/v1.0.1","exporters/otlp/otlptrace/otlptracegrpc/v1.0.1","exporters/otlp/otlpmetric/v0.24.0","exporters/otlp/otlpmetric/otlpmetrichttp/v0.24.0","exporters/otlp/otlpmetric/otlpmetricgrpc/v0.24.0","exporters/jaeger/v1.0.1","example/zipkin/v1.0.1","example/prometheus/v0.24.0","example/passthrough/v1.0.1","example/otel-collector/v1.0.1","example/opencensus/v0.24.0","example/namedtracer/v1.0.1","example/jaeger/v1.0.1","example/fib/v1.0.1","bridge/opentracing/v1.0.1","bridge/opencensus/v0.24.0","bridge/opencensus/test/v0.24.0","v1.0.0","trace/v1.0.0","sdk/v1.0.0","exporters/zipkin/v1.0.0","exporters/stdout/stdouttrace/v1.0.0","exporters/otlp/otlptrace/v1.0.0","exporters/otlp/otlptrace/otlptracehttp/v1.0.0","exporters/otlp/otlptrace/otlptracegrpc/v1.0.0","exporters/jaeger/v1.0.0","example/zipkin/v1.0.0","example/passthrough/v1.0.0","example/otel-collector/v1.0.0","example/namedtracer/v1.0.0","example/jaeger/v1.0.0","example/fib/v1.0.0","bridge/opentracing/v1.0.0","v1.0.0-RC3","trace/v1.0.0-RC3","sdk/v1.0.0-RC3","sdk/metric/v0.23.0","sdk/export/metric/v0.23.0","oteltest/v1.0.0-RC3","metric/v0.23.0","internal/metric/v0.23.0","exporters/zipkin/v1.0.0-RC3","exporters/stdout/stdouttrace/v1.0.0-RC3","exporters/stdout/stdoutmetric/v0.23.0","exporters/prometheus/v0.23.0","exporters/otlp/otlptrace/v1.0.0-RC3","exporters/otlp/otlptrace/otlptracehttp/v1.0.0-RC3","exporters/otlp/otlptrace/otlptracegrpc/v1.0.0-RC3","exporters/otlp/otlpmetric/v0.23.0","exporters/otlp/otlpmetric/otlpmetrichttp/v0.23.0","exporters/otlp/otlpmetric/otlpmetricgrpc/v0.23.0","exporters/jaeger/v1.0.0-RC3","example/zipkin/v1.0.0-RC3","example/prometheus/v0.23.0","example/passthrough/v1.0.0-RC3","example/otel-collector/v1.0.0-RC3","example/opencensus/v0.23.0","example/namedtracer/v1.0.0-RC3","example/jaeger/v1.0.0-RC3","example/fib/v1.0.0-RC3","bridge/opentracing/v1.0.0-RC3","bridge/opencensus/v0.23.0","bridge/opencensus/test/v0.23.0","v1.0.0-RC2","trace/v1.0.0-RC2","sdk/v1.0.0-RC2","oteltest/v1.0.0-RC2","exporters/zipkin/v1.0.0-RC2","exporters/stdout/stdouttrace/v1.0.0-RC2","exporters/otlp/otlptrace/v1.0.0-RC2","exporters/otlp/otlptrace/otlptracehttp/v1.0.0-RC2","exporters/otlp/otlptrace/otlptracegrpc/v1.0.0-RC2","exporters/jaeger/v1.0.0-RC2","example/zipkin/v1.0.0-RC2","example/passthrough/v1.0.0-RC2","example/otel-collector/v1.0.0-RC2","example/namedtracer/v1.0.0-RC2","example/jaeger/v1.0.0-RC2","bridge/opentracing/v1.0.0-RC2","sdk/metric/v0.22.0","sdk/export/metric/v0.22.0","metric/v0.22.0","internal/metric/v0.22.0","exporters/stdout/stdoutmetric/v0.22.0","exporters/prometheus/v0.22.0","exporters/otlp/otlpmetric/v0.22.0","exporters/otlp/otlpmetric/otlpmetrichttp/v0.22.0","exporters/otlp/otlpmetric/otlpmetricgrpc/v0.22.0","example/prometheus/v0.22.0","v1.0.0-RC1","trace/v1.0.0-RC1","sdk/v1.0.0-RC1","sdk/metric/v0.21.0","sdk/export/metric/v0.21.0","oteltest/v1.0.0-RC1","metric/v0.21.0","internal/metric/v0.21.0","exporters/zipkin/v1.0.0-RC1","exporters/trace/zipkin/v1.0.0-RC1","exporters/trace/jaeger/v1.0.0-RC1","exporters/stdout/stdouttrace/v1.0.0-RC1","exporters/stdout/stdoutmetric/v0.21.0","exporters/prometheus/v0.21.0","exporters/otlp/otlptrace/v1.0.0-RC1","exporters/otlp/otlptrace/otlptracehttp/v1.0.0-RC1","exporters/otlp/otlptrace/otlptracegrpc/v1.0.0-RC1","exporters/otlp/otlpmetric/v0.21.0","exporters/otlp/otlpmetric/otlpmetricgrpc/v0.21.0","exporters/metric/prometheus/v0.21.0","exporters/jaeger/v1.0.0-RC1","example/zipkin/v1.0.0-RC1","example/prometheus/v0.21.0","example/passthrough/v1.0.0-RC1","example/otel-collector/v1.0.0-RC1","example/opencensus/v0.21.0","example/namedtracer/v1.0.0-RC1","example/jaeger/v1.0.0-RC1","bridge/opentracing/v0.21.0","bridge/opencensus/v0.21.0","v0.19.0","trace/v0.19.0","sdk/v0.19.0","sdk/metric/v0.19.0","sdk/export/metric/v0.19.0","oteltest/v0.19.0","metric/v0.19.0","exporters/trace/zipkin/v0.19.0","exporters/trace/jaeger/v0.19.0","exporters/stdout/v0.19.0","exporters/otlp/v0.19.0","exporters/metric/prometheus/v0.19.0","example/zipkin/v0.19.0","example/prometheus/v0.19.0","example/prom-collector/v0.19.0","example/otel-collector/v0.19.0","example/opencensus/v0.19.0","example/namedtracer/v0.19.0","example/jaeger/v0.19.0","bridge/opentracing/v0.19.0","bridge/opencensus/v0.19.0","v0.18.0","trace/v0.18.0","sdk/v0.18.0","sdk/metric/v0.18.0","sdk/export/metric/v0.18.0","oteltest/v0.18.0","metric/v0.18.0","exporters/trace/zipkin/v0.18.0","exporters/trace/jaeger/v0.18.0","exporters/stdout/v0.18.0","exporters/otlp/v0.18.0","exporters/metric/prometheus/v0.18.0","example/zipkin/v0.18.0","example/prometheus/v0.18.0","example/prom-collector/v0.18.0","example/otel-collector/v0.18.0","example/opencensus/v0.18.0","example/namedtracer/v0.18.0","example/jaeger/v0.18.0","bridge/opentracing/v0.18.0","bridge/opencensus/v0.18.0","v0.17.0","trace/v0.17.0","sdk/v0.17.0","sdk/metric/v0.17.0","sdk/export/metric/v0.17.0","oteltest/v0.17.0","metric/v0.17.0","exporters/trace/zipkin/v0.17.0","exporters/trace/jaeger/v0.17.0","exporters/stdout/v0.17.0","exporters/otlp/v0.17.0","exporters/metric/prometheus/v0.17.0","example/zipkin/v0.17.0","example/prometheus/v0.17.0","example/prom-collector/v0.17.0","example/otel-collector/v0.17.0","example/opencensus/v0.17.0","example/namedtracer/v0.17.0","example/jaeger/v0.17.0","bridge/opentracing/v0.17.0","bridge/opencensus/v0.17.0","v0.16.0","sdk/v0.16.0","exporters/trace/zipkin/v0.16.0","exporters/trace/jaeger/v0.16.0","exporters/stdout/v0.16.0","exporters/otlp/v0.16.0","exporters/metric/prometheus/v0.16.0","example/zipkin/v0.16.0","example/prometheus/v0.16.0","example/prom-collector/v0.16.0","example/otel-collector/v0.16.0","example/opencensus/v0.16.0","example/namedtracer/v0.16.0","example/jaeger/v0.16.0","bridge/opentracing/v0.16.0","bridge/opencensus/v0.16.0","v0.15.0","sdk/v0.15.0","exporters/trace/zipkin/v0.15.0","exporters/trace/jaeger/v0.15.0","exporters/stdout/v0.15.0","exporters/otlp/v0.15.0","exporters/metric/prometheus/v0.15.0","example/zipkin/v0.15.0","example/prometheus/v0.15.0","example/otel-collector/v0.15.0","example/opencensus/v0.15.0","example/namedtracer/v0.15.0","example/jaeger/v0.15.0","example/basic/v0.15.0","bridge/opentracing/v0.15.0","bridge/opencensus/v0.15.0","v0.14.0","sdk/v0.14.0","exporters/trace/zipkin/v0.14.0","exporters/trace/jaeger/v0.14.0","exporters/stdout/v0.14.0","exporters/otlp/v0.14.0","exporters/metric/prometheus/v0.14.0","example/zipkin/v0.14.0","example/prometheus/v0.14.0","example/otel-collector/v0.14.0","example/namedtracer/v0.14.0","example/jaeger/v0.14.0","example/basic/v0.14.0","bridge/opentracing/v0.14.0","bridge/opencensus/v0.14.0","bridge/opencensus/examples/bridge/v0.14.0","v0.13.0","sdk/v0.13.0","exporters/trace/zipkin/v0.13.0","exporters/trace/jaeger/v0.13.0","exporters/stdout/v0.13.0","exporters/otlp/v0.13.0","exporters/metric/prometheus/v0.13.0","example/zipkin/v0.13.0","example/prometheus/v0.13.0","example/otel-collector/v0.13.0","example/namedtracer/v0.13.0","example/jaeger/v0.13.0","example/basic/v0.13.0","bridge/opentracing/v0.13.0","v0.12.0","sdk/v0.12.0","exporters/trace/zipkin/v0.12.0","exporters/trace/jaeger/v0.12.0","exporters/stdout/v0.12.0","exporters/otlp/v0.12.0","exporters/metric/prometheus/v0.12.0","example/zipkin/v0.12.0","example/prometheus/v0.12.0","example/otel-collector/v0.12.0","example/namedtracer/v0.12.0","example/jaeger/v0.12.0","example/basic/v0.12.0","bridge/opentracing/v0.12.0","v0.11.0","sdk/v0.11.0","exporters/trace/zipkin/v0.11.0","exporters/trace/jaeger/v0.11.0","exporters/stdout/v0.11.0","exporters/otlp/v0.11.0","exporters/metric/prometheus/v0.11.0","example/zipkin/v0.11.0","example/prometheus/v0.11.0","example/otel-collector/v0.11.0","example/namedtracer/v0.11.0","example/jaeger/v0.11.0","example/basic/v0.11.0","bridge/opentracing/v0.11.0","v0.10.0","sdk/v0.10.0","exporters/trace/zipkin/v0.10.0","exporters/trace/jaeger/v0.10.0","exporters/stdout/v0.10.0","exporters/otlp/v0.10.0","exporters/metric/prometheus/v0.10.0","example/zipkin/v0.10.0","example/prometheus/v0.10.0","example/otel-collector/v0.10.0","example/namedtracer/v0.10.0","example/jaeger/v0.10.0","example/http/v0.10.0","example/grpc/v0.10.0","example/basic/v0.10.0","v0.9.0","exporters/trace/zipkin/v0.9.0","exporters/trace/jaeger/v0.9.0","exporters/otlp/v0.9.0","exporters/metric/prometheus/v0.9.0","example/zipkin/v0.9.0","example/prometheus/v0.9.0","example/otel-collector/v0.9.0","example/namedtracer/v0.9.0","example/jaeger/v0.9.0","example/http/v0.9.0","example/grpc/v0.9.0","example/basic/v0.9.0","v0.8.0","exporters/trace/zipkin/v0.8.0","exporters/trace/jaeger/v0.8.0","exporters/otlp/v0.8.0","exporters/metric/prometheus/v0.8.0","example/zipkin/v0.8.0","example/prometheus/v0.8.0","example/otel-collector/v0.8.0","example/namedtracer/v0.8.0","example/jaeger/v0.8.0","example/http/v0.8.0","example/grpc/v0.8.0","example/basic/v0.8.0","v0.7.0","exporters/trace/zipkin/v0.7.0","exporters/trace/jaeger/v0.7.0","exporters/otlp/v0.7.0","exporters/metric/prometheus/v0.7.0","example/zipkin/v0.7.0","example/prometheus/v0.7.0","example/otel-collector/v0.7.0","example/namedtracer/v0.7.0","example/jaeger/v0.7.0","example/http/v0.7.0","example/grpc/v0.7.0","example/basic/v0.7.0","v0.6.0","exporters/trace/zipkin/v0.6.0","exporters/trace/jaeger/v0.6.0","exporters/otlp/v0.6.0","exporters/metric/prometheus/v0.6.0","example/zipkin/v0.6.0","example/prometheus/v0.6.0","example/otel-collector/v0.6.0","example/namedtracer/v0.6.0","example/jaeger/v0.6.0","example/http/v0.6.0","example/grpc/v0.6.0","example/basic/v0.6.0","v0.4.3","exporters/trace/zipkin/v0.4.3","exporters/trace/jaeger/v0.4.3","exporters/otlp/v0.4.3","exporters/metric/prometheus/v0.4.3","example/zipkin/v0.4.3","example/prometheus/v0.4.3","example/namedtracer/v0.4.3","example/jaeger/v0.4.3","example/http/v0.4.3","example/grpc/v0.4.3","example/basic/v0.4.3","v0.4.2","exporters/trace/zipkin/v0.4.2","exporters/trace/jaeger/v0.4.2","exporters/otlp/v0.4.2","exporters/metric/prometheus/v0.4.2","example/zipkin/v0.4.2","example/prometheus/v0.4.2","example/namedtracer/v0.4.2","example/jaeger/v0.4.2","example/http/v0.4.2","example/grpc/v0.4.2","example/basic/v0.4.2","v0.4.1","exporters/trace/zipkin/v0.4.1","exporters/trace/jaeger/v0.4.1","exporters/otlp/v0.4.1","exporters/metric/prometheus/v0.4.1","example/zipkin/v0.4.1","example/prometheus/v0.4.1","example/namedtracer/v0.4.1","example/jaeger/v0.4.1","example/http/v0.4.1","example/grpc/v0.4.1","example/basic/v0.4.1","v0.4.0","exporters/trace/zipkin/v0.4.0","exporters/trace/jaeger/v0.4.0","exporters/otlp/v0.4.0","exporters/metric/prometheus/v0.4.0","example/zipkin/v0.4.0","example/prometheus/v0.4.0","example/namedtracer/v0.4.0","example/jaeger/v0.4.0","example/http/v0.4.0","example/grpc/v0.4.0","example/basic/v0.4.0","v0.3.0","exporters/trace/zipkin/v0.3.0","exporters/trace/jaeger/v0.3.0","exporters/otlp/v0.3.0","exporters/metric/prometheus/v0.3.0","example/zipkin/v0.3.0","example/prometheus/v0.3.0","example/namedtracer/v0.3.0","example/jaeger/v0.3.0","example/http/v0.3.0","example/grpc/v0.3.0","example/basic/v0.3.0","v0.2.3","tools/v0.2.3","exporters/trace/stackdriver/v0.2.3","exporters/trace/jaeger/v0.2.3","exporters/metric/prometheus/v0.2.3","example/prometheus/v0.2.3","example/namedtracer/v0.2.3","example/jaeger/v0.2.3","example/http/v0.2.3","example/http-stackdriver/v0.2.3","example/grpc/v0.2.3","example/basic/v0.2.3","v0.2.2","v0.2.1.1","v0.2.1","exporter/trace/stackdriver/v0.2.1","exporter/trace/jaeger/v0.2.1","exporter/metric/prometheus/v0.2.1","example/prometheus/v0.2.1","example/namedtracer/v0.2.1","example/jaeger/v0.2.1","example/http/v0.2.1","example/http-stackdriver/v0.2.1","example/grpc/v0.2.1","example/basic/v0.2.1","v0.2.0","exporter/trace/stackdriver/v0.2.0","exporter/trace/jaeger/v0.2.0","exporter/metric/prometheus/v0.2.0","v0.1.2","exporter/trace/stdout/v0.1.2","exporter/trace/stackdriver/v0.1.2","exporter/trace/jaeger/v0.1.2","v0.1.1","exporter/trace/stdout/v0.1.1","exporter/trace/stackdriver/v0.1.1","exporter/trace/jaeger/v0.1.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-45287.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}