go.opentelemetry.io/otel/sdk (Go)
OpenTelemetry Go API and SDK
Advisories
12
Latest version
v1.47.0
Released Oct 2, 2026
License
Apache-2.0, BSD-3-Clause
OpenSSF Scorecard
9.2 / 10
How to fix
Upgrading to 1.45.0 or later clears every advisory below that has a fix.
Upgrade commands
go
go get go.opentelemetry.io/otel/sdk@v1.47.0 && go mod tidyKnown vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-p9f8-wvj8-2fg8 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation |
Medium EPSS 0.18% |
>= 1.10.0, < 1.33.0 | 1.33.0 |
| GHSA-p9f8-wvj8-2fg8 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation |
Medium EPSS 0.18% |
>= 1.10.0, < 1.33.0 | 1.33.0 |
| GHSA-p9f8-wvj8-2fg8 OpenTelemetry-Go: UTF-8 replacement rune bypasses attribute length truncation |
Medium EPSS 0.18% |
>= 1.10.0, < 1.33.0 | 1.33.0 |
| GHSA-8wmf-6v46-5gfg OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
Low EPSS 0.27% |
>= 1.5.0, < 1.45.0 | 1.45.0 |
| GHSA-8wmf-6v46-5gfg OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
Low EPSS 0.27% |
>= 1.5.0, <= 1.44.0 | No fix yet |
| GHSA-8wmf-6v46-5gfg OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
Low EPSS 0.27% |
>= 1.5.0, < 1.45.0 | 1.45.0 |
| GHSA-hfvc-g4fc-pqhx opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking |
High EPSS 0.25% |
>= 1.15.0, < 1.43.0 | 1.43.0 |
| GHSA-hfvc-g4fc-pqhx opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking |
High EPSS 0.25% |
>= 1.15.0, < 1.43.0 | 1.43.0 |
| GHSA-hfvc-g4fc-pqhx opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking |
High EPSS 0.25% |
>= 1.15.0, <= 1.42.0 | No fix yet |
| GHSA-9h8m-3fm2-qjrq OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking |
High EPSS 0.18% |
>= 1.21.0, < 1.40.0 | 1.40.0 |
| GHSA-9h8m-3fm2-qjrq OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking |
High EPSS 0.18% |
>= 1.21.0, < 1.40.0 | 1.40.0 |
| GHSA-9h8m-3fm2-qjrq OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking |
High EPSS 0.18% |
>= 1.21.0, < 1.40.0 | 1.40.0 |
Source: https://github.com/open-telemetry/opentelemetry-go
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor