Skip to content

Update module go.opentelemetry.io/otel/bridge/opentracing to v1.45.0 [SECURITY] - #596

Merged
pulumi-renovate[bot] merged 1 commit into
mainfrom
renovate/security
Aug 21, 2026
Merged

Update module go.opentelemetry.io/otel/bridge/opentracing to v1.45.0 [SECURITY]#596
pulumi-renovate[bot] merged 1 commit into
mainfrom
renovate/security

Conversation

@pulumi-renovate

@pulumi-renovate pulumi-renovate Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
go.opentelemetry.io/otel/bridge/opentracing v1.33.0 → v1.45.0 age confidence

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access

CVE-2026-45404 / GHSA-42cj-99w8-cp2p

More information

Details

Summary

go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span.

Introduced in commit: 8cddf30

Details

bridge/opentracing/bridge.go:80-85 adds extraBaggageItems map[string]string to bridgeSpan without a mutex or other synchronization primitive. bridge/opentracing/bridge.go:219-234 shows SetBaggageItem calling updateOtelContext, which lazily creates the map and writes s.extraBaggageItems[restrictedKey] = value without locking. bridge/opentracing/bridge.go:359-377 shows correlationGetHook reading bSpan.extraBaggageItems, checking len(items), and iterating for k, v := range items without locking. The finding evidence also identifies api/correlation/context.go:160-165 as the path where correlation.MapFromContext invokes the get hook, allowing a read path to run concurrently with baggage writes.

Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can terminate the process with a runtime error such as fatal error: concurrent map read and map write or fatal error: concurrent map iteration and map write.

PoC

validation-artifact.zip

The validation artifact contains a PoC at validation-artifact.tar:validation_poc_concurrent_map.go and supporting notes at validation-artifact.tar:validation_poc_README.txt.

Use a checkout of pellared/opentelemetry-go at commit 8cddf30 with Go module downloads enabled. The local validation environment could not complete the run because GOPROXY=off blocked dependency resolution; that blocked output is saved in validation-artifact.tar:validation_poc_run.log.

Commands:

cd /path/to/opentelemetry-go
git checkout 8cddf30
tar -xOf /path/to/finding-directory/validation-artifact.tar validation_poc_concurrent_map.go > ./validation_poc_concurrent_map.go
GOPROXY=https://proxy.golang.org,direct go run ./validation_poc_concurrent_map.go

The PoC starts a BridgeTracer, creates a span, installs correlation hooks with tracer.NewHookedContext(ctx), initializes baggage once, then runs one goroutine repeatedly calling span.SetBaggageItem(...) while another repeatedly calls otelcorrelation.MapFromContext(ctx). A vulnerable build is expected to terminate with a Go runtime concurrent map access error, for example:

fatal error: concurrent map read and map write

or:

fatal error: concurrent map iteration and map write
Impact

This is a race condition / improper synchronization vulnerability in a shared Go map. Applications using the OpenTelemetry OpenTracing bridge with correlation hooks can crash if the same bridgeSpan is accessed concurrently, with one execution path setting baggage and another propagating correlation baggage. The practical impact is denial of service for the affected application process; exposure depends on whether application request handling or internal concurrency can trigger those operations on the same span.

Severity

  • CVSS Score: 5.9 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/bridge/opentracing)

v1.45.0: /v0.67.0/v0.21.0/v0.0.18

Compare Source

Overview

Added
  • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#​7124)
  • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#​8251)
  • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#​8445)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#​8453)
  • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#​8453)
  • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#​8454)
  • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#​8471)
  • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#​8471)
  • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#​8471)
  • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package.
    The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#​8484)
  • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#​8532)
  • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package.
    The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions.
    See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#​8628)
Changed
  • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#​8306)
  • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#​8490)
  • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#​8490)
  • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#​8511)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#​8538)
  • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#​8538)
Deprecated
  • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#​8620)
Removed
  • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#​8490)
  • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#​8556)
Fixed
  • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
  • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#​8309)
  • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8383)
  • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#​8389)
  • Prevent a non-empty attribute set whose computed hash is zero from collapsing to an empty set in go.opentelemetry.io/otel/attribute. (#​8402)
  • Fix histogram data point reuse in go.opentelemetry.io/otel/sdk/metric aggregation to avoid leaking stale sum, minimum, and maximum values when they are disabled in subsequent collections. (#​8403)
  • Avoid preallocating scope attributes when they are disabled in go.opentelemetry.io/otel/exporters/prometheus. (#​8404)
  • Support HTTP-date values in the HTTP Retry-After header when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#​8417)
  • Reduce histogram heap allocations by reusing BucketCounts and Exemplars slices across Collect cycles in the cumulative histogram aggregation in go.opentelemetry.io/otel/sdk/metric. (#​8428)
  • Fix go.opentelemetry.io/otel/exporters/stdout/stdouttrace self-observability to record error.type on the operation-duration histogram when the exportedSpans metric is disabled. (#​8432)
  • Stop including trace exporter endpoint configuration in internal logs from go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, and go.opentelemetry.io/otel/exporters/zipkin. (#​8438)
  • Fix invalid error formatting for out-of-range JSON code values in go.opentelemetry.io/otel/codes. (#​8497)
  • Clarify in go.opentelemetry.io/otel/log that Logger.Enabled should be checked for every log emission because its result may change over time. (#​8565)
  • Preserve user-provided exception attributes while independently deriving missing exception message and type attributes in go.opentelemetry.io/otel/sdk/log. (#​8566)
  • Make WithAttributeCountLimit(0) and OTEL_LOGRECORD_ATTRIBUTE_COUNT_LIMIT=0 discard all log record attributes in go.opentelemetry.io/otel/sdk/log. (#​8570)
  • Clarify that the Record methods of Float64Histogram and Int64Histogram in go.opentelemetry.io/otel/metric expect non-negative values. (#​8574)
  • Clarify in go.opentelemetry.io/otel/log that LoggerProvider implementations should retain an empty Logger name instead of replacing it with a default. (#​8587)
  • Ensure that the built-in processors in go.opentelemetry.io/otel/sdk/log call exporter ForceFlush during Shutdown. (#​8599)
  • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem. (GHSA-42cj-99w8-cp2p)
  • Prevent processor operations in go.opentelemetry.io/otel/sdk/log from overlapping with processor shutdown or running after LoggerProvider shutdown. (#​8608)
  • Prevent BatchProcessor in go.opentelemetry.io/otel/sdk/log from busy-spinning under exporter backpressure and serialize dequeue, export, force-flush, and shutdown work in one worker. (#​8620)
  • Make BatchProcessor in go.opentelemetry.io/otel/sdk/log return errors encountered while draining records during ForceFlush and Shutdown, while continuing to attempt later batches as long as the request context remains valid. (#​8620)
  • Keep the default BatchProcessor maximum export batch size in go.opentelemetry.io/otel/sdk/log at or below the configured maximum queue size. (#​8620)

What's Changed

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

@pulumi-renovate pulumi-renovate Bot added dependencies Pull requests that update a dependency file impact/no-changelog-required This issue doesn't require a CHANGELOG update labels Aug 21, 2026
@pulumi-renovate
pulumi-renovate Bot enabled auto-merge (squash) August 21, 2026 08:31
@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown

Does the PR have any schema changes?

Generated by schema-tools v0.8.1.

Found 1 breaking change:

Functions

  • 🔴 "xyz:index/dataSource:DataSource" missing

New functions:

  • index/getDataSource.getDataSource

Maintainer note: consult the runbook for dealing with any breaking changes.

@codecov

codecov Bot commented Aug 21, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.00%. Comparing base (4bcae0b) to head (3c31348).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files 
@@          Coverage Diff          @@
##            main    #596   +/-   ##
=====================================
  Coverage   0.00%   0.00%           
=====================================
  Files          1       1           
  Lines         61      61           
=====================================
  Misses        61      61

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@pulumi-renovate
pulumi-renovate Bot merged commit 27e60a0 into main Aug 21, 2026
26 checks passed
@pulumi-renovate
pulumi-renovate Bot deleted the renovate/security branch August 21, 2026 08:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pulumi-renovate-approve pulumi-renovate-approve[bot] pulumi-renovate-approve[bot] approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file impact/no-changelog-required This issue doesn't require a CHANGELOG update

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants