THREAT OPS › Threat News › [GHSA] GHSA-42cj-99w8-cp2p (medium) — OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
[GHSA] GHSA-42cj-99w8-cp2p (medium) — OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
GHSA-42cj-99w8-cp2p Severity: medium CVE: CVE-2026-45404
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
### Summary
`go.opentelemetry.io/otel/bridge/opentracing` introduced an unsynchronized `extraBaggageItems` map on `bridgeSpan`. One goroutine can write this map through `Span.SetBaggageItem` while another goroutine reads and iterates it during correlation bagga
Indicators of compromise
- CVE-2026-45404cve
- https://proxy.golang.org,directurl
- go.opentelemetry.iodomain
Original source: https://github.com/advisories/GHSA-42cj-99w8-cp2p