Vendor
Open-telemetry
62 known vulnerabilities in products by Open-telemetry, 0 of them actively exploited (CISA KEV).
Key figures
62
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-33701 | OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution | 9.8 | |
| High | CVE-2023-47108 | DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics | 7.5 | |
| High | CVE-2023-45142 | OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics | 7.5 | |
| High | CVE-2024-36129 | OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC | 8.2 | |
| Medium | CVE-2026-55701 | OpenTelemetry githubreceiver silently ignores configured required_headers authentication | — | |
| Medium | CVE-2026-45292 | opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation | 5.3 | |
| High | CVE-2026-29181 | Opentelemetry-go: Allocation of Resources Without Limits or Throttling | 7.5 | |
| High | CVE-2026-47701 | Opentelemetry-operator: Exposure of Sensitive Information to an Unauthorized Actor | 7.7 | |
| High | CVE-2026-59892 | Opentelemetry-js: Uncaught Exception | 7.5 | |
| Medium | CVE-2026-118259 | opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing | 5.3 | |
| Medium | CVE-2026-114603 | OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api | 5.3 | |
| High | CVE-2023-25151 | DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib | 7.5 | |
| High | CVE-2026-54712 | OpenTelemetry Javaagent RMI context propagation allows resource exhaustion | 7.5 | |
| Medium | CVE-2026-116694 | OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation | — | |
| High | CVE-2026-44902 | opentelemetry-js: Prometheus exporter process crash via malformed HTTP request | 7.5 | |
| High | CVE-2026-45685 | OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages | 7.5 | |
| High | CVE-2023-43810 | opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics | 7.5 | |
| Medium | CVE-2026-81872 | OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full | — | |
| Medium | CVE-2026-47256 | Opentelemetry-collector-contrib: Path Traversal | 5.3 | |
| High | CVE-2026-45686 | OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI | 7.5 | |
| Medium | CVE-2023-39951 | Opentelemetry-java-instrumentation: Exposure of Sensitive Information to an Unauthorized Actor | 6.5 | |
| High | CVE-2026-45678 | OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads | 7.5 | |
| High | CVE-2026-81192 | Opentelemetry-dotnet-contrib: Untrusted Search Path | 7.0 | |
| Medium | CVE-2026-104872 | @opentelemetry Instrumentation-cassandra-driver: Insertion of Sensitive Information into Log File | 5.8 | |
| Medium | CVE-2026-54704 | OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords | 6.5 |