Vulnerability-Lookup

CVE-2026-45404 (GCVE-0-2026-45404)

Vulnerability from cvelistv5 – Published: 2026-08-24 21:19 – Updated: 2026-08-27 14:18

Title

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-27 14:18 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-667 - Improper Locking

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC
https://github.com/open-telemetry/opentelemetry-g…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
open-telemetry	opentelemetry-go	Affected: >= 0.11.0, < 1.45.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-45404",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-27T14:18:31.891717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-27T14:18:58.878Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-go",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.11.0, \u003c 1.45.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge\u0027s bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error\u2014such as concurrent map read and map write or concurrent map iteration and map write\u2014terminating the process and causing denial of service. This issue is fixed in version 1.45.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-667",
              "description": "CWE-667: Improper Locking",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-24T21:19:00.617Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/pull/8693",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/8693"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0"
        }
      ],
      "source": {
        "advisory": "GHSA-42cj-99w8-cp2p",
        "discovery": "UNKNOWN"
      },
      "title": "OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-45404",
    "datePublished": "2026-08-24T21:19:00.617Z",
    "dateReserved": "2026-05-12T01:48:40.451Z",
    "dateUpdated": "2026-08-27T14:18:58.878Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45404",
      "date": "2026-08-27",
      "epss": "0.00131",
      "percentile": "0.03018"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45404\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-24T22:16:53.020\",\"lastModified\":\"2026-08-27T17:18:24.840\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge\u0027s bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error\u2014such as concurrent map read and map write or concurrent map iteration and map write\u2014terminating the process and causing denial of service. This issue is fixed in version 1.45.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"open-telemetry\",\"product\":\"opentelemetry-go\",\"versions\":[{\"version\":\"\u003e= 0.11.0, \u003c 1.45.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-27T14:18:31.891717Z\",\"id\":\"CVE-2026-45404\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"references\":[{\"url\":\"https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-go/pull/8693\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-362\", \"lang\": \"en\", \"description\": \"CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-667\", \"lang\": \"en\", \"description\": \"CWE-667: Improper Locking\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 5.9, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p\"}, {\"name\": \"https://github.com/open-telemetry/opentelemetry-go/pull/8693\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/open-telemetry/opentelemetry-go/pull/8693\"}, {\"name\": \"https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8\"}, {\"name\": \"https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0\"}], \"affected\": [{\"vendor\": \"open-telemetry\", \"product\": \"opentelemetry-go\", \"versions\": [{\"version\": \"\u003e= 0.11.0, \u003c 1.45.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-24T21:19:00.617Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge\u0027s bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error\\u2014such as concurrent map read and map write or concurrent map iteration and map write\\u2014terminating the process and causing denial of service. This issue is fixed in version 1.45.0.\"}], \"source\": {\"advisory\": \"GHSA-42cj-99w8-cp2p\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-45404\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-27T14:18:31.891717Z\"}}}], \"references\": [{\"url\": \"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-27T14:18:50.415Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-45404\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-05-12T01:48:40.451Z\", \"datePublished\": \"2026-08-24T21:19:00.617Z\", \"dateUpdated\": \"2026-08-27T14:18:58.878Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-45404

Vulnerability from fkie_nvd - Published: 2026-08-24 22:16 - Updated: 2026-08-24 22:16

Severity

5.9 (Medium) - CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-go/pull/8693
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "opentelemetry-go",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.11.0, \u003c 1.45.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge\u0027s bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error\u2014such as concurrent map read and map write or concurrent map iteration and map write\u2014terminating the process and causing denial of service. This issue is fixed in version 1.45.0."
    }
  ],
  "id": "CVE-2026-45404",
  "lastModified": "2026-08-24T22:16:53.020",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-24T22:16:53.020",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-go/pull/8693"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-362"
        },
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-42CJ-99W8-CP2P

Vulnerability from github – Published: 2026-08-20 17:26 – Updated: 2026-08-20 17:26

Summary

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

Details

Summary

go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span.

Introduced in commit: 8cddf30

Details

bridge/opentracing/bridge.go:80-85 adds extraBaggageItems map[string]string to bridgeSpan without a mutex or other synchronization primitive. bridge/opentracing/bridge.go:219-234 shows SetBaggageItem calling updateOtelContext, which lazily creates the map and writes s.extraBaggageItems[restrictedKey] = value without locking. bridge/opentracing/bridge.go:359-377 shows correlationGetHook reading bSpan.extraBaggageItems, checking len(items), and iterating for k, v := range items without locking. The finding evidence also identifies api/correlation/context.go:160-165 as the path where correlation.MapFromContext invokes the get hook, allowing a read path to run concurrently with baggage writes.

Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can terminate the process with a runtime error such as fatal error: concurrent map read and map write or fatal error: concurrent map iteration and map write.

PoC

validation-artifact.zip

The validation artifact contains a PoC at validation-artifact.tar:validation_poc_concurrent_map.go and supporting notes at validation-artifact.tar:validation_poc_README.txt.

Use a checkout of pellared/opentelemetry-go at commit 8cddf30 with Go module downloads enabled. The local validation environment could not complete the run because GOPROXY=off blocked dependency resolution; that blocked output is saved in validation-artifact.tar:validation_poc_run.log.

Commands:

cd /path/to/opentelemetry-go
git checkout 8cddf30
tar -xOf /path/to/finding-directory/validation-artifact.tar validation_poc_concurrent_map.go > ./validation_poc_concurrent_map.go
GOPROXY=https://proxy.golang.org,direct go run ./validation_poc_concurrent_map.go

The PoC starts a BridgeTracer, creates a span, installs correlation hooks with tracer.NewHookedContext(ctx), initializes baggage once, then runs one goroutine repeatedly calling span.SetBaggageItem(...) while another repeatedly calls otelcorrelation.MapFromContext(ctx). A vulnerable build is expected to terminate with a Go runtime concurrent map access error, for example:

fatal error: concurrent map read and map write

or:

fatal error: concurrent map iteration and map write

Impact

This is a race condition / improper synchronization vulnerability in a shared Go map. Applications using the OpenTelemetry OpenTracing bridge with correlation hooks can crash if the same bridgeSpan is accessed concurrently, with one execution path setting baggage and another propagating correlation baggage. The practical impact is denial of service for the affected application process; exposure depends on whether application request handling or internal concurrency can trigger those operations on the same span.

Severity

5.9 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "go.opentelemetry.io/otel/bridge/opentracing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.11.0"
            },
            {
              "fixed": "1.45.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45404"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-362",
      "CWE-667"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T17:26:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`go.opentelemetry.io/otel/bridge/opentracing` introduced an unsynchronized `extraBaggageItems` map on `bridgeSpan`. One goroutine can write this map through `Span.SetBaggageItem` while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go\u0027s fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span.\n\nIntroduced in commit: 8cddf30\n\n### Details\n\n`bridge/opentracing/bridge.go:80-85` adds `extraBaggageItems map[string]string` to `bridgeSpan` without a mutex or other synchronization primitive. `bridge/opentracing/bridge.go:219-234` shows `SetBaggageItem` calling `updateOtelContext`, which lazily creates the map and writes `s.extraBaggageItems[restrictedKey] = value` without locking. `bridge/opentracing/bridge.go:359-377` shows `correlationGetHook` reading `bSpan.extraBaggageItems`, checking `len(items)`, and iterating `for k, v := range items` without locking. The finding evidence also identifies `api/correlation/context.go:160-165` as the path where `correlation.MapFromContext` invokes the get hook, allowing a read path to run concurrently with baggage writes.\n\nBecause Go maps are not safe for concurrent read/write access, concurrent `SetBaggageItem` and `correlation.MapFromContext` calls on the same hooked `bridgeSpan` can terminate the process with a runtime error such as `fatal error: concurrent map read and map write` or `fatal error: concurrent map iteration and map write`.\n\n### PoC\n\n[validation-artifact.zip](https://github.com/user-attachments/files/27494614/validation-artifact.zip)\n\n\nThe validation artifact contains a PoC at `validation-artifact.tar:validation_poc_concurrent_map.go` and supporting notes at `validation-artifact.tar:validation_poc_README.txt`.\n\nUse a checkout of `pellared/opentelemetry-go` at commit `8cddf30` with Go module downloads enabled. The local validation environment could not complete the run because `GOPROXY=off` blocked dependency resolution; that blocked output is saved in `validation-artifact.tar:validation_poc_run.log`.\n\nCommands:\n\n```sh\ncd /path/to/opentelemetry-go\ngit checkout 8cddf30\ntar -xOf /path/to/finding-directory/validation-artifact.tar validation_poc_concurrent_map.go \u003e ./validation_poc_concurrent_map.go\nGOPROXY=https://proxy.golang.org,direct go run ./validation_poc_concurrent_map.go\n```\n\nThe PoC starts a `BridgeTracer`, creates a span, installs correlation hooks with `tracer.NewHookedContext(ctx)`, initializes baggage once, then runs one goroutine repeatedly calling `span.SetBaggageItem(...)` while another repeatedly calls `otelcorrelation.MapFromContext(ctx)`. A vulnerable build is expected to terminate with a Go runtime concurrent map access error, for example:\n\n```text\nfatal error: concurrent map read and map write\n```\n\nor:\n\n```text\nfatal error: concurrent map iteration and map write\n```\n\n\n### Impact\n\nThis is a race condition / improper synchronization vulnerability in a shared Go map. Applications using the OpenTelemetry OpenTracing bridge with correlation hooks can crash if the same `bridgeSpan` is accessed concurrently, with one execution path setting baggage and another propagating correlation baggage. The practical impact is denial of service for the affected application process; exposure depends on whether application request handling or internal concurrency can trigger those operations on the same span.",
  "id": "GHSA-42cj-99w8-cp2p",
  "modified": "2026-08-20T17:26:14Z",
  "published": "2026-08-20T17:26:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-go/pull/8693"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.45.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-45404 (GCVE-0-2026-45404)

FKIE_CVE-2026-45404

GHSA-42CJ-99W8-CP2P

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature