# CVE-2026-45287: OpenTelemetry-Go file descriptor leak in schema ParseFile

Source: https://junglewise.ai/threats/cve-2026-45287-opentelemetry-go-file-descriptor-leak-in-schema-parsefile  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-45287 · Severity: medium · CVSS 4 · Published 2026-06-04

OpenTelemetry-Go is a library used for instrumenting applications to collect performance and diagnostic data. A flaw in the library's schema parsing component causes it to leak system resources (file descriptors) every time a schema file is processed. If an application using this library repeatedly parses files—especially if triggered by external input—it can eventually crash or become unresponsive, leading to a denial of service.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry).

## Quick answers

**Is CVE-2026-45287 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45287 being exploited in the wild.

**How severe is CVE-2026-45287?** Medium severity, with a CVSS score of 4, published 4 June 2026.

**Which products and versions are affected?** go.opentelemetry.io/otel/schema (Go) SEMVER:introduced=0,fixed=0.0.17; go.opentelemetry.io/otel/schema/v1.0 (Go) <= 0.0.16, SEMVER:introduced=0,fixed=0.0.17; go.opentelemetry.io/otel/schema/v1.1 (Go) <= 0.0.16, SEMVER:introduced=0,fixed=0.0.17; Opentelemetry Go Schema v1.0 <= 0.0.16; and 1 more.

**Is there a fix for CVE-2026-45287?** Yes. go.opentelemetry.io/otel/schema (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.0 (Go): upgrade to 0.0.17 or later; go.opentelemetry.io/otel/schema/v1.1 (Go): upgrade to 0.0.17 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45287 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-45287?** Check whether you run go.opentelemetry.io/otel/schema (Go), go.opentelemetry.io/otel/schema/v1.0 (Go), go.opentelemetry.io/otel/schema/v1.1 (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.opentelemetry.io/otel/schema (Go): upgrade to 0.0.17 or later

  ```sh
  go get go.opentelemetry.io/otel/schema@v0.0.17
  ```

- go.opentelemetry.io/otel/schema/v1.0 (Go): upgrade to 0.0.17 or later

  ```sh
  go get go.opentelemetry.io/otel/schema/v1.0@v0.0.17
  ```

- go.opentelemetry.io/otel/schema/v1.1 (Go): upgrade to 0.0.17 or later

  ```sh
  go get go.opentelemetry.io/otel/schema/v1.1@v0.0.17
  ```


## Technical details

A resource leak exists in the `ParseFile` function within the `go.opentelemetry.io/otel/schema` package (v1.0 and v1.1). The function opens a schema file using `os.Open` but fails to close the resulting file descriptor after passing it to the `Parse` function. Because the `Parse` function accepts an `io.Reader` and does not take ownership of the closing logic, the descriptor remains open until the Go runtime eventually finalizes the object. In long-running processes or those that expose schema parsing to attacker-controlled paths, this leads to file descriptor exhaustion (EMFILE), causing a denial of service. The issue is resolved in version 0.0.17.

## Affected products

- OpenTelemetry go.opentelemetry.io/otel/schema/v1.0 <= v0.0.16
- OpenTelemetry go.opentelemetry.io/otel/schema/v1.1 <= v0.0.16

## Identifiers

- CVE-2026-45287
- GHSA-995v-fvrw-c78m
- GO-2026-5281

## Timeline

- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-06-04: disclosed: CVE-2026-45287 published to NVD

## References

- [https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684](https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684)
- [https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d](https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d)
- [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m)