2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45287

CVE-2026-45287: opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45287

CVE-2026-45287:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
go.opentelemetry.io/otel/schema/v1.1	go	<= 0.0.16	0.0.17
go.opentelemetry.io/otel/schema/v1.0	go	<= 0.0.16	0.0.17

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a file descriptor leak in the opentelemetry-go library, specifically within the schema module. The root cause of the vulnerability is in the ParseFile function, which is present in both v1.0 and v1.1 of the schema parsing packages. The analysis of the introducing commit e72a235 shows that the ParseFile function in schema/v1.0/parser.go opens a file using os.Open but fails to close it. The returned file handle is passed to the Parse function, which reads from it but does not close it, as it's not the owner of the resource. This results in a file descriptor leak on every call to ParseFile. The security advisory GHSA-995v-fvrw-c78m confirms this vulnerability and also states that go.opentelemetry.io/otel/schema/v1.1 is affected by the same issue. Although the commit for v1.1 is not analyzed, the advisory's information is considered reliable. An attacker who can trigger repeated calls to ParseFile in an application can cause the application to exhaust its file descriptor limit, leading to a denial of service. The vulnerable function that would appear in a runtime profile is ParseFile.

Vulnerable functions

ParseFile

schema/v1.0/parser.go

The function `ParseFile` in `schema/v1.0/parser.go` opens a file using `os.Open` but does not close it. The file descriptor is passed to the `Parse` function, which also does not close it, leading to a file descriptor leak. Repeated calls to this function can exhaust the process's file descriptor limit, causing a denial of service.

ParseFile

schema/v1.1/parser.go

The function `ParseFile` in `schema/v1.1/parser.go` opens a file using `os.Open` but does not close it. The file descriptor is passed to the `Parse` function, which also does not close it, leading to a file descriptor leak. Repeated calls to this function can exhaust the process's file descriptor limit, causing a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.