CVE-2026-45287: OpenTelemetry-Go File Descriptor Leak & Denial of Service

Technical summary

The vulnerability exists in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` packages. The `ParseFile` function opens a file descriptor for the schema file but does not close it before passing the file handle to the `Parse` function. In stateless or batch-oriented applications this may be benign, but in long-running services that perform repeated parsing (especially when file paths are derived from user or external input), the cumulative leak exhausts the process file descriptor ulimit. Once the limit is reached, all subsequent file operations—logging, network I/O, database connections—fail, resulting in denial of service. The fix in version 0.0.17 ensures proper file closure after parsing.

Business impact

Services relying on OpenTelemetry-Go for telemetry schema validation are at risk if they parse schemas in response to external requests or in high-frequency loops. Affected deployments may experience unexpected service outages when file descriptors are exhausted, with symptoms appearing as 'too many open files' errors in application logs. This is particularly concerning for containerized environments where file descriptor limits are often tightly constrained. Recovery requires process restart, and the DoS condition can be triggered repeatedly if the underlying application logic remains unchanged.

Affected systems

Any application using OpenTelemetry-Go versions prior to 0.0.17 that calls `ParseFile` on `otel/schema/v1.0` or `otel/schema/v1.1` packages is potentially affected. Risk is highest in services that invoke `ParseFile` repeatedly—for example, those that parse schemas on per-request basis, in initialization loops, or when processing dynamic configuration. Applications that parse schemas only once during startup and cache the results face minimal risk.

Exploitability

Direct remote exploitation is not possible; an attacker cannot remotely trigger schema parsing unless the target application explicitly exposes that functionality. Exploitability depends entirely on application design. Services that accept file paths as input parameters, hot-reload schemas based on external configuration, or parse schemas in response to API requests create an exploitable condition. An authenticated user or external actor with the ability to influence schema file paths or trigger parsing logic can cause denial of service. The attack is low-complexity once the vulnerable code path is identified.

Remediation

Upgrade to OpenTelemetry-Go version 0.0.17 or later. Applications unable to upgrade immediately should audit their schema parsing logic: if `ParseFile` is called only at startup or infrequently, risk is reduced. Consider implementing rate-limiting or input validation around any user-supplied file paths passed to `ParseFile`. For high-risk environments, monitor file descriptor usage and set alerts for approaching the process limit.

Patch guidance

Apply OpenTelemetry-Go version 0.0.17 or later. Verify the update by checking the go.mod file and running `go list -m all` to confirm the installed version. Recompile and redeploy affected services. If you maintain internal mirrors or vendored dependencies, prioritize this update in your release cycle. Test in non-production environments first to confirm no side effects; the fix is a resource management improvement with no breaking API changes.

Detection guidance

Monitor application logs for 'too many open files' or 'EMFILE' errors, particularly if they correlate with increased request volume or configuration reloads. Use system-level tools like `lsof` or `/proc/[pid]/fd` to inspect file descriptor usage in running OpenTelemetry-Go-based processes. If file descriptor count climbs steadily during normal operation without corresponding file closures, investigate whether `ParseFile` is being called repeatedly. Correlate timing of file descriptor exhaustion with access logs to identify patterns of triggering requests.

Why prioritize this

This is a medium-severity resource exhaustion vulnerability suitable for standard patching cycles. It requires application-specific exposure to attacker-controlled schema parsing, preventing it from being automatically exploitable in most deployments. However, it should not be deprioritized: any service that dynamically loads or reloads schemas faces real DoS risk, and the fix is simple and low-risk. Organizations should triage based on whether their OpenTelemetry-Go usage pattern includes repeated `ParseFile` calls.

Risk score, explained

CVSS 5.5 (Medium) reflects local or authenticated attack surface (AV:L, PR:L), no confidentiality or integrity impact (C:N, I:N), and high availability impact (A:H). The score appropriately captures the resource exhaustion nature: the vulnerability is not easily exploitable from the network, but causes complete service denial once triggered. The low access vector and privilege requirement mean most organizations are not at immediate risk unless they have specifically exposed schema parsing logic to external or low-privileged users.

Frequently asked questions