MEDIUM GitHub
CVE-2026-45404
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
### Summary
`go.opentelemetry.io/otel/bridge/opentracing` introduced an unsynchronized `extraBaggageItems` map on `bridgeSpan`. One goroutine can write this map through `Span.SetBaggageItem` while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span.
In
Affected Products
- go/go.opentelemetry.io/otel/bridge/opentracing >= 0.11.0, < 1.45.0
References
- https://github.com/advisories/GHSA-42cj-99w8-cp2p
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-42cj-99w8-cp2p
- https://github.com/open-telemetry/opentelemetry-go/pull/8693
- https://github.com/open-telemetry/opentelemetry-go/commit/93a693edeed0e07ce5ebd1dfe67af42d
This medium severity vulnerability was published on 2026-08-20 via GitHub. Affected: go/go.opentelemetry.io/otel/bridge/opentracing >= 0.11.0, < 1.45.0.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.