Is CVE-2026-45287 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45287 being exploited in the wild.

How severe is CVE-2026-45287?

Medium severity, with a CVSS score of 4, published 4 June 2026.

Which products and versions are affected?

go.opentelemetry.io/otel/schema (Go) SEMVER:introduced=0,fixed=0.0.17; go.opentelemetry.io/otel/schema/v1.0 (Go) <= 0.0.16, SEMVER:introduced=0,fixed=0.0.17; go.opentelemetry.io/otel/schema/v1.1 (Go) <= 0.0.16, SEMVER:introduced=0,fixed=0.0.17; Opentelemetry Go Schema v1.0 <= 0.0.16; and 1 more.

Is there a fix for CVE-2026-45287?

Yes. go.opentelemetry.io/otel/schema (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.0 (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.1 (Go): upgrade to 0.0.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45287 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-45287?

Check whether you run go.opentelemetry.io/otel/schema (Go), go.opentelemetry.io/otel/schema/v1.0 (Go), go.opentelemetry.io/otel/schema/v1.1 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45287: OpenTelemetry-Go file descriptor leak in schema ParseFile

Q: Is there a fix for CVE-2026-45287?

Yes. go.opentelemetry.io/otel/schema (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.0 (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.1 (Go): upgrade to 0.0.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45287 attacked?

It is attacked with local access, in a software library.

Q: Am I affected by CVE-2026-45287?

Check whether you run go.opentelemetry.io/otel/schema (Go), go.opentelemetry.io/otel/schema/v1.0 (Go), go.opentelemetry.io/otel/schema/v1.1 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45287 · Severity: medium · CVSS 4 · Published 2026-06-04

OpenTelemetry-Go is a library used for instrumenting applications to collect performance and diagnostic data. A flaw in the library's schema parsing component causes it to leak system resources (file descriptors) every time a schema file is processed. If an application using this library repeatedly parses files—especially if triggered by external input—it can eventually crash or become unresponsive, leading to a denial of service.

Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-45287 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45287 being exploited in the wild.
How severe is CVE-2026-45287?: Medium severity, with a CVSS score of 4, published 4 June 2026.
Which products and versions are affected?: go.opentelemetry.io/otel/schema (Go) SEMVER:introduced=0,fixed=0.0.17; go.opentelemetry.io/otel/schema/v1.0 (Go) <= 0.0.16, SEMVER:introduced=0,fixed=0.0.17; go.opentelemetry.io/otel/schema/v1.1 (Go) <= 0.0.16, SEMVER:introduced=0,fixed=0.0.17; Opentelemetry Go Schema v1.0 <= 0.0.16; and 1 more.
Is there a fix for CVE-2026-45287?: Yes. go.opentelemetry.io/otel/schema (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.0 (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.1 (Go): upgrade to 0.0.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45287 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-45287?: Check whether you run go.opentelemetry.io/otel/schema (Go), go.opentelemetry.io/otel/schema/v1.0 (Go), go.opentelemetry.io/otel/schema/v1.1 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/otel/schema (Go): upgrade to 0.0.17 or later
```
go get go.opentelemetry.io/otel/schema@v0.0.17
```
go.opentelemetry.io/otel/schema/v1.0 (Go): upgrade to 0.0.17 or later
```
go get go.opentelemetry.io/otel/schema/v1.0@v0.0.17
```
go.opentelemetry.io/otel/schema/v1.1 (Go): upgrade to 0.0.17 or later
```
go get go.opentelemetry.io/otel/schema/v1.1@v0.0.17
```

Technical details

A resource leak exists in the `ParseFile` function within the `go.opentelemetry.io/otel/schema` package (v1.0 and v1.1). The function opens a schema file using `os.Open` but fails to close the resulting file descriptor after passing it to the `Parse` function. Because the `Parse` function accepts an `io.Reader` and does not take ownership of the closing logic, the descriptor remains open until the Go runtime eventually finalizes the object. In long-running processes or those that expose schema parsing to attacker-controlled paths, this leads to file descriptor exhaustion (EMFILE), causing a denial of service. The issue is resolved in version 0.0.17.

Affected products

OpenTelemetry go.opentelemetry.io/otel/schema/v1.0 <= v0.0.16
OpenTelemetry go.opentelemetry.io/otel/schema/v1.1 <= v0.0.16

Identifiers

CVE-2026-45287
GHSA-995v-fvrw-c78m
GO-2026-5281

Timeline

2026-05-28: advisory: GitHub Security Advisory published
2026-06-04: disclosed: CVE-2026-45287 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.