Your message dated Fri, 02 Oct 2026 22:19:04 +0000
with message-id <[email protected]>
and subject line Bug#1139167: fixed in golang-opentelemetry-otel 1.46.0-2
has caused the Debian Bug report #1139167,
regarding golang-opentelemetry-otel: CVE-2026-41178
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1139167: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139167
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: golang-opentelemetry-otel
Version: 1.43.0-4
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for golang-opentelemetry-otel.
CVE-2026-41178[0]:
| OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions
| 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse`
| to process arbitrarily large/invalid baggage headers and log errors,
| enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix
| the issue.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-41178
https://www.cve.org/CVERecord?id=CVE-2026-41178
[1]
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835
[2] https://github.com/open-telemetry/opentelemetry-go/pull/7880
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: golang-opentelemetry-otel
Source-Version: 1.46.0-2
Done: Reinhard Tartler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
golang-opentelemetry-otel, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Reinhard Tartler <[email protected]> (supplier of updated
golang-opentelemetry-otel package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 02 Oct 2026 17:52:31 -0400
Source: golang-opentelemetry-otel
Architecture: source
Version: 1.46.0-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Reinhard Tartler <[email protected]>
Closes: 1139167 1139168
Changes:
golang-opentelemetry-otel (1.46.0-2) unstable; urgency=medium
.
* Team upload.
.
[ Juan Manuel Méndez Rey ]
* Upload to unstable. No changes since 1.46.0-1~exp1, which has been in
experimental since 2026-09-27 together with golang-opentelemetry-contrib
1.46.0-1~exp1.
.
[ Reinhard Tartler ]
* d/lintian-overrides: suppress
package-contains-documentation-outside-usr-share-doc
* d/patches: clean up and standardize DEP-3 headers
* debian/control: upgrade to debhelper-compat (= 14)
.
golang-opentelemetry-otel (1.46.0-1) unstable; urgency=medium
.
* Team upload.
[ Mathias Gibbens ]
* Cleanup DH_GOLANG_EXCLUDES and DH_GOLANG_INSTALL_EXTRA
* Cleanup Build-Depends and Depends
.
[ Andrew Lee (李健秋) ]
* debian/watch: switch to version 5.
* New upstream version 1.44.0
* debian/control: update dependency to matches with go.mod.
* Drop legacy patch.
* debian/control: switch to Module-Aware builds via dh-go.
* New upstream version 1.46.0
* debian/rules: do not cut down dependency with DH_GOLANG_EXCLUDES.
* debian/rules: drop debhelper's buildsystem option as it's been
specified in debian/control.
* add-missing-depends.patch: fix FTBFS in tests.
.
golang-opentelemetry-otel (1.46.0-1~exp1) experimental; urgency=medium
.
* Team upload.
* Upload to experimental to stage the 1.46 transition, which also needs
golang-opentelemetry-contrib, prometheus-alertmanager and prometheus.
* New upstream version 1.46.0
- Adds attribute.MapValue and switches go.opentelemetry.io/otel/log
to attribute.Value/attribute.KeyValue. Needed by siso, which cannot
move past 1.5.22 without it (see #1141687).
* Fix CVE-2026-45287: file descriptor leak in schema ParseFile.
(Closes: #1139168)
* Fix CVE-2026-41178: DoS via oversized baggage headers. (Closes:
#1139167)
* debian/control: bump Breaks for prometheus-alertmanager-dev and
prometheus-dev: sdk/resource now uses semconv v1.43.0, older versions
fail tracer provider setup with a conflicting schema URL.
* debian/control: build against golang-github-cespare-xxhash-v2-dev,
which ships the module at github.com/cespare/xxhash/v2, the path the
import in go.mod resolves to.
* debian/control: add back golang-github-masterminds-semver-dev to
Build-Depends and Depends. schema/internal imports
github.com/Masterminds/semver/v3, so without it the autopkgtest fails
to build the package.
* debian/salsa-ci.yml: use the standard Salsa CI pipeline and drop
debian/gitlab-ci.yml, which only ran the pkg-go archive test.
* debian/patches: drop 0001-Fix-import-comment.patch, upstream removed
the import comment.
* debian/watch: use the GitHub refs API, so stable vX.Y.Z tags are not
hidden by per-module and pre-release tags.
Checksums-Sha1:
17bcd7ae8383d7635ecbcf5679294732dae308e2 2842
golang-opentelemetry-otel_1.46.0-2.dsc
ac80874058709966323c581739e27355c524affe 5264
golang-opentelemetry-otel_1.46.0-2.debian.tar.xz
Checksums-Sha256:
c38367bd32d413a3dc8276fb0ccec5318914ab4065de81697b440eff01c5bf1c 2842
golang-opentelemetry-otel_1.46.0-2.dsc
fa3eedf337a041ae7ac34b896de38c293058dee4980cbc70be8d21f99814eb30 5264
golang-opentelemetry-otel_1.46.0-2.debian.tar.xz
Files:
8cd46e72edb6989d0b106a90fadcfcdd 2842 golang optional
golang-opentelemetry-otel_1.46.0-2.dsc
785adcfc79bdf15e2336e98b5d69d145 5264 golang optional
golang-opentelemetry-otel_1.46.0-2.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmrAKJwUHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJstd8w/+LoYDyR09A89987g8CqQcwuI8qEDP
WZEc+Wq2BI77pBQ2Uhy1rOyxgIIxFL1p6qcDONmOBo1isryedX4ktNYSpPZCjwL9
mXiGQK7nKjEyAudRNe7Tccf1GdzOJlAH/uPAZeuutNMBJoAQzi528h5ZzPTC588W
p9/Abv91x8psxXDFjQpTWLccpuWcMaS7UIHi+9RLfuuhoJk7nzZMq/rSM8fUoq9m
nms2YvSxZAjcPfQLI3Tlid/CinzmJOpwFL94VLjvL0EfKFabmJKL2Fu6IcFkaUiR
ZXMiky9ejY/c7u6HczXVZ2z+1Ao0Y5W58U3FOOLboLSHMU6ujkbiX2P6v8j7muRm
hkyRCWGmr0szojll4CsJ272SxoMNqxt/W1z5wFO93TqTXHA+o6H7SkSGP+da+dN4
GRwwAVI0lGFYNRPlG/6zryN/hzrU1IDMy7uWgzZA4uPvzl0BSboHCyde64JT5PI5
cfqS9O4xoAemHrmhfAwXhliF8rzh8octUYaoW6vN0dxSLZbBVnCMhaKRRt9Zl+3h
gMMktalylxStOi7TwYhHVIiLF44amoDzxsY0rXNZ5eUgZoUt50KeINeBKGz3dh6Z
5r0mJJT9DBIPIaW8eLPB0apv1oiHmTtjREwqGHJG9hh/ppA/aSA9Nh9FYGUOui2t
9FfBgaabFK3UkK4=
=jTKz
-----END PGP SIGNATURE-----
pgpcf_AGmlvza.pgp
Description: PGP signature
--- End Message ---
