{"action":"Upgrade go.opentelemetry.io/otel/schema to 0.0.17 or later.","affected":[{"fixed":"0.0.17","introduced":"0"}],"component":"go.opentelemetry.io/otel/schema","cve_ids":["CVE-2026-45287"],"ecosystem":"Go","epss":0.00175,"exploited":false,"fixed_versions":["0.0.17"],"ghsa_id":"GHSA-995v-fvrw-c78m","id":"tcs_01M5KGK7H7CS5Q9SNNVCBG52CC","modified_at":"2026-06-25T19:45:23.220359827Z","published_at":"2026-06-25T18:43:15Z","references":["https://osv.dev/vulnerability/GO-2026-5281","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m","https://nvd.nist.gov/vuln/detail/CVE-2026-45287","https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684","https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5281","url":"https://osv.dev/vulnerability/GO-2026-5281"}],"summary":"opentelemetry-go's Schema ParseFile leaks file descriptors on each parse in go.opentelemetry.io/otel/schema"}