CVE-2026-45404: OpenTelemetry-Go DOS Vulnerability

CVE-2026-45404 Overview

CVE-2026-45404 is a race condition vulnerability in OpenTelemetry-Go, the Go implementation of OpenTelemetry. The flaw resides in the OpenTracing bridge's bridgeSpan structure, which contains an unsynchronized extraBaggageItems map. Because Go maps are not safe for concurrent read/write access, simultaneous SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error. The result is process termination and denial of service. Affected releases span version 0.11.0 through 1.44.0, and the issue is resolved in version 1.45.0. The vulnerability is categorized under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact
Concurrent access to the unsynchronized baggage map causes a fatal Go runtime panic, terminating the host process and producing a denial-of-service condition in any application using the OpenTracing bridge.

Affected Products

OpenTelemetry-Go go.opentelemetry.io/otel versions 0.11.0 through 1.44.0
OpenTelemetry-Go OpenTracing bridge component (bridge/opentracing)
Go applications using the OpenTracing compatibility shim with hooked spans

Discovery Timeline

2026-08-24 - CVE-2026-45404 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-45404

Vulnerability Analysis

The vulnerability exists in the OpenTracing compatibility bridge inside OpenTelemetry-Go. The bridgeSpan type maintains an extraBaggageItems map used to carry baggage items propagated through the OpenTracing API. This map is accessed by multiple code paths without a mutex or other synchronization primitive.

When goroutines concurrently invoke SetBaggageItem (a writer) and correlation.MapFromContext (a reader/iterator) on the same span instance, the Go runtime detects unsafe map access. The runtime raises a fatal error such as concurrent map read and map write or concurrent map iteration and map write. Unlike a recoverable panic, this fatal error cannot be caught by recover() and terminates the entire process. The fix in version 1.45.0 introduces proper synchronization around the baggage map.

Root Cause

The root cause is missing synchronization on a shared data structure. The extraBaggageItems map on bridgeSpan is accessible from multiple goroutines through the OpenTracing API surface, yet no sync.Mutex, sync.RWMutex, or sync.Map protects it. Go's built-in map type is documented as unsafe for concurrent use when at least one goroutine performs a write. This is a classic [CWE-362] race condition.

Attack Vector

Exploitation requires local access to a Go application that uses the OpenTracing bridge and executes span operations concurrently. An attacker who can trigger concurrent baggage reads and writes on the same span, either through legitimate application input or by driving multi-threaded request handling paths, can crash the process. No authentication or privileges are required against the vulnerable code path itself, but the trigger must originate within the process boundary or via inputs that produce concurrent span operations.

// Security patch in bridge/opencensus/version.go - Release v1.45.0 (#8693)
// Version is the current release version of the opencensus bridge.
func Version() string {
-	return "1.44.0"
+	return "1.45.0"
}
// Source: https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d1e2055d8

Detection Methods for CVE-2026-45404

Indicators of Compromise

Unexpected process termination with Go runtime fatal error messages containing fatal error: concurrent map read and map write or concurrent map iteration and map write.
Crash stack traces referencing bridgeSpan.SetBaggageItem or correlation.MapFromContext within go.opentelemetry.io/otel/bridge/opentracing.
Elevated restart counts on Go services or containers using OpenTelemetry-Go versions between 0.11.0 and 1.44.0.

Detection Strategies

Perform software composition analysis on Go modules to identify go.opentelemetry.io/otel at versions 0.11.0 through 1.44.0 with the OpenTracing bridge imported.
Parse crash logs and container exit events for Go runtime panics that mention baggage handling or the OpenTracing bridge code paths.
Correlate service crash patterns with concurrent request bursts that exercise tracing baggage APIs.

Monitoring Recommendations

Monitor process restart metrics and unclean exit codes on services instrumented with OpenTelemetry-Go.
Alert on Go runtime fatal error strings in stdout/stderr collected by log pipelines.
Track dependency drift so upgrades to OpenTelemetry-Go 1.45.0 or later are verified across the fleet.

How to Mitigate CVE-2026-45404

Immediate Actions Required

Upgrade go.opentelemetry.io/otel and related modules to version 1.45.0 or later, then rebuild and redeploy affected services.
Inventory all Go services using the OpenTracing bridge and prioritize those exposed to high-concurrency workloads.
Review crash reports from the past deployment window to confirm whether the race has already been triggered in production.

Patch Information

The issue is fixed in OpenTelemetry-Go v1.45.0. The upstream fix is tracked in GitHub Pull Request #8693 and delivered in the GitHub Release v1.45.0. Full technical context is available in the GitHub Security Advisory GHSA-42cj-99w8-cp2p and the GitHub Commit Changes.

Workarounds

If immediate upgrade is not possible, avoid using the OpenTracing bridge (bridge/opentracing) and migrate to the native OpenTelemetry API.
Serialize access to spans that receive baggage updates so SetBaggageItem and baggage reads do not execute concurrently on the same span.
Limit baggage manipulation to span creation time and treat spans as read-only afterward until the patched version is deployed.

bash

# Configuration example: upgrade OpenTelemetry-Go modules
go get go.opentelemetry.io/otel@v1.45.0
go get go.opentelemetry.io/otel/sdk@v1.45.0
go get go.opentelemetry.io/otel/sdk/metric@v1.45.0
go get go.opentelemetry.io/otel/trace@v1.45.0
go mod tidy
go build ./...