CVE-2026-128085 (Medium) detected in go.opentelemetry.io/otel/trace-v1.43.0
还没有人认领这个 Issue。
评估
调研方向
受影响的模块是 go.opentelemetry.io/otel/trace v1.43.0，列在依赖文件 /engine/go.mod 中，通过 github.com/docker/docker 间接引入。先检查 go.mod 中哪个条目锁定了该版本，然后运行 go get go.opentelemetry.io/otel/[email protected]，再在 /engine 中运行 go mod tidy。完成的标准是：go.mod 和 go.sum 显示 v1.47.0，go build ./... 和现有的 go test ./... 都通过，并且没有其他版本不匹配的 otel 模块残留。
由索引模型根据 Issue 内容生成。
描述
CVE-2026-128085 - Medium Severity Vulnerability
Vulnerable Library - go.opentelemetry.io/otel/trace-v1.43.0
OpenTelemetry Go API and SDK
Library home page: https://proxy.golang.org/go.opentelemetry.io/otel/trace/@v/v1.43.0.zip
Sample Path to Dependency File: /engine/go.mod
Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/go.opentelemetry.io/otel/trace/@v/v1.43.0.mod
Dependency Hierarchy:
- github.com/docker/docker-v28.5.2 (Root Library)
- ❌ go.opentelemetry.io/otel/trace-v1.43.0 (Vulnerable Library)
Found in base branch: master
Vulnerability Details
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnorm, sdk/log/internal/attrnorm, and trace/auto.go do not count valid U+FFFD replacement characters. This is a distinct incomplete-fix defect in the replacement truncation code introduced by the remediation for CVE-2026-81869. Values composed of or dominated by those characters can therefore exceed the configured character and memory bound in span, log-record, and auto-instrumentation trace attributes. Attacker-controlled telemetry attributes can increase retained memory and pipeline pressure, while confidentiality and integrity are not affected. This issue is fixed in version 1.47.0.
Publish Date: 2026-11-13
URL: CVE-2026-128085
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-q7gw-24fr-5p69
Release Date: 2026-11-13
Fix Resolution: go.opentelemetry.io/otel/trace - v1.47.0
Step up your Open Source Security Game with Mend here
- 主要语言
- Go
- 星标
- 2.8k
- 派生
- 90
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
postgres-ai/database-lab-engine 的其他 Issue
-
难度 4/5 3-5 天 新手友好度 45/100
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 45/100
-
good first issue
难度 3/5 1-2 天 新手友好度 35/100
postgres-ai/database-lab-engine#203 · 2 条评论 ·
查看 postgres-ai/database-lab-engine 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 62/100
-
evener-transcript-v2-upgrade tool still scans transcript files through bufio's 4 KiB default buffer未关闭
难度 1/5 1 小时以内 新手友好度 78/100
prime-radiant-inc/evener#6370 ·
维护者通常 1 天内回复
-
ManageSieve proxy: a backend's NO/BYE greeting is skipped as a capability line and reported as EOF未关闭bug
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
Mend: dependency security vulnerability
难度 2/5 1-3 小时 新手友好度 62/100
ManageIQ/manageiq-pods#1476 ·
维护者通常 1 天内回复
-
mcp: typed tool handlers lose wrapped JSON-RPC errors可能重新可做 关联的 PR 已关闭且未合并。 未关闭
难度 2/5 1-3 小时 新手友好度 85/100
modelcontextprotocol/go-sdk#1529 · 1 条评论 ·
维护者通常 1 天内回复