Your message dated Sun, 27 Sep 2026 20:36:45 +0000
with message-id <[email protected]>
and subject line Bug#1139168: fixed in golang-opentelemetry-otel 1.46.0-1~exp1
has caused the Debian Bug report #1139168,
regarding golang-opentelemetry-otel: CVE-2026-45287
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1139168: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139168
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: golang-opentelemetry-otel
Version: 1.43.0-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for golang-opentelemetry-otel.
CVE-2026-45287[0]:
| OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to
| version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and
| `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on
| each successful `ParseFile` call. `ParseFile` opens the schema file
| and passes it to `Parse` without closing it; repeated parsing in a
| long-running process can exhaust the process file descriptor limit
| and cause denial of service. Exploitation depends on a consuming
| application exposing repeated schema parsing to an attacker-
| controlled path. Version 0.0.17 contains a patch for the issue.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-45287
https://www.cve.org/CVERecord?id=CVE-2026-45287
[1]
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m
[2]
https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: golang-opentelemetry-otel
Source-Version: 1.46.0-1~exp1
Done: Juan Manuel Méndez Rey <[email protected]>
We believe that the bug you reported is fixed in the latest version of
golang-opentelemetry-otel, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Juan Manuel Méndez Rey <[email protected]> (supplier of updated
golang-opentelemetry-otel package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 20 Sep 2026 21:58:45 +0200
Source: golang-opentelemetry-otel
Architecture: source
Version: 1.46.0-1~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Juan Manuel Méndez Rey <[email protected]>
Closes: 1139167 1139168
Changes:
golang-opentelemetry-otel (1.46.0-1~exp1) experimental; urgency=medium
.
* Team upload.
* Upload to experimental to stage the 1.46 transition, which also needs
golang-opentelemetry-contrib, prometheus-alertmanager and prometheus.
* New upstream version 1.46.0
- Adds attribute.MapValue and switches go.opentelemetry.io/otel/log
to attribute.Value/attribute.KeyValue. Needed by siso, which cannot
move past 1.5.22 without it (see #1141687).
* Fix CVE-2026-45287: file descriptor leak in schema ParseFile.
(Closes: #1139168)
* Fix CVE-2026-41178: DoS via oversized baggage headers. (Closes:
#1139167)
* debian/control: bump Breaks for prometheus-alertmanager-dev and
prometheus-dev: sdk/resource now uses semconv v1.43.0, older versions
fail tracer provider setup with a conflicting schema URL.
* debian/control: build against golang-github-cespare-xxhash-v2-dev,
which ships the module at github.com/cespare/xxhash/v2, the path the
import in go.mod resolves to.
* debian/control: add back golang-github-masterminds-semver-dev to
Build-Depends and Depends. schema/internal imports
github.com/Masterminds/semver/v3, so without it the autopkgtest fails
to build the package.
* debian/salsa-ci.yml: use the standard Salsa CI pipeline and drop
debian/gitlab-ci.yml, which only ran the pkg-go archive test.
* debian/patches: drop 0001-Fix-import-comment.patch, upstream removed
the import comment.
* debian/watch: use the GitHub refs API, so stable vX.Y.Z tags are not
hidden by per-module and pre-release tags.
Checksums-Sha1:
16587e70360e022fbf67af69eeba024ffa15ff51 2705
golang-opentelemetry-otel_1.46.0-1~exp1.dsc
8046c38187747dfc48bdfcc6b45a9df2b551f725 1217036
golang-opentelemetry-otel_1.46.0.orig.tar.xz
809b63270330eba941fb429bf98118b9508ff8a0 5304
golang-opentelemetry-otel_1.46.0-1~exp1.debian.tar.xz
a3bb105b7f71d76bc69fd9eb6c690106ccb12256 6533
golang-opentelemetry-otel_1.46.0-1~exp1_source.buildinfo
Checksums-Sha256:
bf5bda367130a0458da3439ba58d60dda2ed6d96f0500343b91d46e5729dbd3a 2705
golang-opentelemetry-otel_1.46.0-1~exp1.dsc
30beb6ac0156d94546961e8248c4eba8dda2989e429a79e5c68346ba2bde379e 1217036
golang-opentelemetry-otel_1.46.0.orig.tar.xz
15c5dc79db572f2628592dae98d54d902b022f0215025a05cc7fea2022e31e60 5304
golang-opentelemetry-otel_1.46.0-1~exp1.debian.tar.xz
812164ae724e0a5d95c56bd968bc651b40e910a2047787eb34c835a78158e915 6533
golang-opentelemetry-otel_1.46.0-1~exp1_source.buildinfo
Files:
2761a38e645e03eb63e26ddff9942383 2705 golang optional
golang-opentelemetry-otel_1.46.0-1~exp1.dsc
3233f65a14378eb19c9c2aed9bc81c19 1217036 golang optional
golang-opentelemetry-otel_1.46.0.orig.tar.xz
f90253b01a8374ed2a24e02d5c6ffa9c 5304 golang optional
golang-opentelemetry-otel_1.46.0-1~exp1.debian.tar.xz
f14abad04decce5b18b576f9f65e8e44 6533 golang optional
golang-opentelemetry-otel_1.46.0-1~exp1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE703UlH90QYpfEyJV58vhUqwX+XMFAmq5ducACgkQ58vhUqwX
+XNoDRAAlgb6LjSMLl9BFFVPXLv2lzQy71Jwtl5BAcIyJ/pfLTq5XqSgoWO4Fix8
061MYDL++CMglWqE+iRI7CiGwbp/SEtcwk/k/Qi4Vb/7Rr5fNxkwV5hVSuffq2fe
1lnA6lDv00RJyW525qv1BF1Iwbn89MbcnHeBa+ZvB3ogvOm6dCGskzGFaVs1/HUq
1kARcel1L7judwQL2kkI/YpH+532TY7YACjh+E0P2H18e9B9OcigOIGHSqzG7iet
IL4WEFCLTDL7SmSBYsfi4gVLyLfUQCtpd3QaLvQu00tE9uMQakWVBjHZ8BuhR3AE
RNu+ms7OnHfjgnhLes7cpuqRbMRCyt/cQcAZyKOCBstdEubuskP03rmUfiIn8IgT
9/VzOQDouTmeJN/vYjRfNSHuYWg6ldVJ4vBdfL0Sk17OraqkuYC2CsC6Y/UYOon4
jctinpfNlhLHBOlEwTp30eghlZI7C0V2d6IigtnzjxZW5GEbgIHyCOri1AVZyV5c
ISKDf2FlGvW2BpHfjzzDCZVgJA09wjP9F/E+LAxztOwQ+ieuIM49znf1yZAbGH9q
zO4/g51SFFhKFTlZYaLV9xdEJ+eVEB6plniaV1zuRwlaoi8A4erFmyVYACXe1GKi
qsehspP0/630v94UStfqM2Et+yVUXlCUkiGeZFbIho9nzxo3gnA=
=LYtf
-----END PGP SIGNATURE-----
pgp91MQJ18QeJ.pgp
Description: PGP signature
--- End Message ---
