golang-opentelemetry-otel - Debian Package Tracker

general

source: golang-opentelemetry-otel (main)
version: 1.43.0-4
maintainer: Debian Go Packaging Team (DMD)
uploaders: Shengjing Zhu [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 1.1.0-2
stable: 1.31.0-4
testing: 1.43.0-4
unstable: 1.43.0-4

versioned links

1.1.0-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.31.0-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.43.0-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

golang-opentelemetry-otel-dev

action needed

A new upstream version is available: 1.44.0 high

A new upstream version 1.44.0 is available, you should consider packaging it.

Created: 2026-05-31 Last update: 2026-07-21 01:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-41178: OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
CVE-2026-45287: OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Created: 2026-06-05 Last update: 2026-06-08 11:00

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-41178: OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
CVE-2026-45287: OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Created: 2026-04-09 Last update: 2026-06-08 11:00

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit ac2d3b23b09d188549e7200594b5684c92542623
Author: Mathias Gibbens <gibmat@debian.org>
Date:   Sun Jul 19 19:52:56 2026 +0000

    Cleanup Build-Depends and Depends

commit c519cdbde2c2f384c3c32d5c7405112d76303437
Author: Mathias Gibbens <gibmat@debian.org>
Date:   Sun Jul 19 19:52:40 2026 +0000

    Cleanup DH_GOLANG_EXCLUDES and DH_GOLANG_INSTALL_EXTRA

Created: 2026-07-19 Last update: 2026-07-19 21:20

1 open merge request in Salsa normal

There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2026-06-10 Last update: 2026-06-10 00:30

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-39882: (needs triaging) OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
CVE-2026-41178: (needs triaging) OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
CVE-2026-45287: (needs triaging) OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-04-09 Last update: 2026-06-08 11:00

3 low-priority security issues in bookworm low

There are 3 open security issues in bookworm.

3 issues left for the package maintainer to handle:

CVE-2026-39882: (needs triaging) OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
CVE-2026-41178: (needs triaging) OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.
CVE-2026-45287: (needs triaging) OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-04-09 Last update: 2026-06-08 11:00

debian/patches: 2 patches to forward upstream low

Among the 2 debian patches available in version 1.43.0-4 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-06-04 19:00

news

[rss feed]

[2026-06-08] golang-opentelemetry-otel 1.43.0-4 MIGRATED to testing (Debian testing watch)
[2026-06-04] Accepted golang-opentelemetry-otel 1.43.0-4 (source) into unstable (Mathias Gibbens)
[2026-06-02] Accepted golang-opentelemetry-otel 1.43.0-3 (source) into unstable (Mathias Gibbens)
[2026-05-19] Accepted golang-opentelemetry-otel 1.43.0-2 (source) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2026-05-17] Accepted golang-opentelemetry-otel 1.43.0-1 (source) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2025-12-14] golang-opentelemetry-otel 1.31.0-6 MIGRATED to testing (Debian testing watch)
[2025-12-11] Accepted golang-opentelemetry-otel 1.31.0-6 (source) into unstable (Simon Josefsson)
[2025-08-21] golang-opentelemetry-otel 1.31.0-5 MIGRATED to testing (Debian testing watch)
[2025-08-18] Accepted golang-opentelemetry-otel 1.31.0-5 (source) into unstable (Daniel Swarbrick)
[2025-03-22] golang-opentelemetry-otel 1.31.0-4 MIGRATED to testing (Debian testing watch)
[2025-03-20] Accepted golang-opentelemetry-otel 1.31.0-4 (source) into unstable (Simon Josefsson)
[2024-11-06] golang-opentelemetry-otel 1.31.0-3 MIGRATED to testing (Debian testing watch)
[2024-11-01] Accepted golang-opentelemetry-otel 1.31.0-3 (source) into unstable (Reinhard Tartler)
[2024-10-31] Accepted golang-opentelemetry-otel 1.31.0-2 (source) into unstable (Reinhard Tartler)
[2024-10-21] Accepted golang-opentelemetry-otel 1.31.0-1 (source) into experimental (Reinhard Tartler)
[2024-08-30] golang-opentelemetry-otel 1.21.0-4 MIGRATED to testing (Debian testing watch)
[2024-08-27] Accepted golang-opentelemetry-otel 1.21.0-4 (source) into unstable (Shengjing Zhu)
[2024-08-18] golang-opentelemetry-otel 1.21.0-3 MIGRATED to testing (Debian testing watch)
[2024-08-15] Accepted golang-opentelemetry-otel 1.21.0-3 (source) into unstable (Shengjing Zhu)
[2024-08-07] golang-opentelemetry-otel 1.21.0-2 MIGRATED to testing (Debian testing watch)
[2024-07-25] Accepted golang-opentelemetry-otel 1.21.0-2 (source) into unstable (Mathias Gibbens)
[2024-06-30] Accepted golang-opentelemetry-otel 1.21.0-1 (source) into experimental (Reinhard Tartler)
[2024-06-15] Accepted golang-opentelemetry-otel 1.19.0-0 (source) into experimental (Reinhard Tartler)
[2024-06-06] Accepted golang-opentelemetry-otel 1.16.0-2 (source) into experimental (Reinhard Tartler)
[2023-06-20] golang-opentelemetry-otel 1.16.0-1 MIGRATED to testing (Debian testing watch)
[2023-06-15] Accepted golang-opentelemetry-otel 1.16.0-1 (source) into unstable (Shengjing Zhu)
[2022-11-03] Accepted golang-opentelemetry-otel 1.10.0-1 (source) into experimental (Thomas Goirand)
[2022-10-26] Accepted golang-opentelemetry-otel 1.10.0-1 (source) into experimental (Thomas Goirand)
[2021-11-21] golang-opentelemetry-otel 1.1.0-2 MIGRATED to testing (Debian testing watch)
[2021-11-18] Accepted golang-opentelemetry-otel 1.1.0-2 (source) into unstable (Shengjing Zhu)

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.31.0-6