Medium, CVSS 5.9GoAmendedPublished
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
CVE-2026-45404 · GHSA-42cj-99w8-cp2p
- Affected
- Go go.opentelemetry.io/otel/bridge/opentracing >= 0.11.0, < 1.45.0
- Fixed in
- 1.45.0· Vendor fix available
- Issue
- go.opentelemetry.io/otel/bridge/opentracing introduced an unsynchronized extraBaggageItems map on bridgeSpan. One goroutine can write this map through Span.SetBaggageItem while another goroutine reads and iterates it during correlation baggage propagation, which can trigger Go's fatal concurrent map access panic and crash the process. The finding is low severity because exploitation requires a specific OpenTracing bridge configuration and concurrent use of the same span. Introduced in commit: 8cddf30 Details bridge/opentracing/bridge.go:80-85 adds extraBaggageItems map[string]string to bridgeSpan without a mutex or other synchronization primitive. bridge/opentracing/bridge.go:219-234 shows SetBaggageItem calling updateOtelContext, which lazily creates the map and writes s.extraBaggageItems[restrictedKey] = value without locking. bridge/opentracing/bridge.go:359-377 shows correlationGetHook reading bSpan.extraBaggageItems, checking len(items), and iterating for k, v := range…
Recommended action: Upgrade to 1.45.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.