[
https://issues.apache.org/jira/browse/TOMEE-4613?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18085401#comment-18085401
]
Markus Jung commented on TOMEE-4613:
------------------------------------
[~rthannee] we can't really fix this as we're bound to the opentelemetry
version through the microprofile specification
> Upgrade opentelemetry-api 1.62.0
> --------------------------------
>
> Key: TOMEE-4613
> URL: https://issues.apache.org/jira/browse/TOMEE-4613
> Project: TomEE
> Issue Type: Dependency upgrade
> Components: TomEE Core Server
> Reporter: RAJU THANNEERU
> Priority: Major
> Fix For: 10.1.6
>
>
> New vulnerability in opentelemetry-api-1.32.0.jar
> |[CVE-2026-45292|https://nvd.nist.gov/vuln/detail/CVE-2026-45292]|5.3|medium|fixed
> in 1.62.0|2026-05-14 23:41:37 +0000
> UTC|[opentelemetry-api_1.32.0|https://otscan.otxlab.net/api/v1/scan/c0feeaee-6ca0-4d14-98ee-326106af0b99/report/html#sha256:1003b350658808dc00e5e231b31f63a05ea8cf225976543bc7a5b3299e2905e9_opentelemetry-api_1.32.0]|this
> image|/usr/local/tomee/lib/opentelemetry-api-1.32.0.jar|
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
