OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic. Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as concurrent map read and map write or concurrent map iteration and map write—terminating the process and causing denial of service. This issue is fixed in version 1.45.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the
    OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic.
    Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and
    correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime error—such as
    concurrent map read and map write or concurrent map iteration and map write—terminating the process and
    causing denial of service. This issue is fixed in version 1.45.0. (CVE-2026-45404)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 0.11.0 through 1.44.0, the     OpenTracing bridge's bridgeSpan contains an unsynchronized extraBaggageItems map which can cause a panic.
    Because Go maps are not safe for concurrent read/write access, concurrent SetBaggageItem and     correlation.MapFromContext calls on the same hooked bridgeSpan can trigger a fatal runtime errorsuch as     concurrent map read and map write or concurrent map iteration and map writeterminating the process and     causing denial of service. This issue is fixed in version 1.45.0. (CVE-2026-45404)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459303	Echo: go.opentelemetry.io/otel/bridge/opentracing: security update to 1.45.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459303	Echo: go.opentelemetry.io/otel/bridge/opentracing: security update to 1.45.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
340711	Linux Distros Unpatched Vulnerability : CVE-2026-45404	Nessus	Misc.	Local	medium
446158	SCA: security update for go.opentelemetry.io/otel/bridge/opentracing (GHSA-42cj-99w8-cp2p)	Tenable Cloud Security	SCA Checks	Local	medium
446158	SCA: security update for go.opentelemetry.io/otel/bridge/opentracing (GHSA-42cj-99w8-cp2p)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-45404

medium

Tenable Plugins

medium

medium

medium

medium

medium