---
id: CVE-2026-45287
aliases:
  - GHSA-995v-fvrw-c78m
  - GO-2026-5281
title: opentelemetry-go's Schema ParseFile leaks file descriptors on each parse
summary: opentelemetry-go's Schema ParseFile leaks file descriptors on each parse
severity: low
vendor: otel
product: go.opentelemetry.io/otel/schema/v1.1
ecosystem: go
affected:
  - go.opentelemetry.io/otel/schema/v1.1 < 0.0.17
  - go.opentelemetry.io/otel/schema/v1.0 < 0.0.17
  - go.opentelemetry.io/otel/schema < 0.0.17
patched:
  - go.opentelemetry.io/otel/schema/v1.1 0.0.17
  - go.opentelemetry.io/otel/schema/v1.0 0.0.17
  - go.opentelemetry.io/otel/schema 0.0.17
published: '2026-05-28'
updated: '2026-07-15'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-995v-fvrw-c78m'
references:
  - url: >-
      https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45287'
  - url: >-
      https://github.com/open-telemetry/opentelemetry-go/commit/e72a235518cb773137efd80336a179028bc34684
  - url: >-
      https://github.com/open-telemetry/opentelemetry-go/commit/f12d198f161b61735d65705248715aa97021ba8d
  - url: 'https://github.com/open-telemetry/opentelemetry-go'
tags:
  - osv
  - go
epss: 0.00168
epssPercentile: 0.0646
ingestedAt: '2026-07-16T18:59:42.504Z'
---

## Overview

### Summary

`go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. The severity is low because exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path.

Introduced in commit: e72a235

### Details

In `schema/v1.0/parser.go:41-47`, `ParseFile` opens the requested schema path with `os.Open` and then returns `Parse(file)` without a `defer file.Close()` or other close path:

```go
file, err := os.Open(schemaFilePath)
if err != nil {
	return nil, err
}
return Parse(file)
```

The validation evidence also identifies `schema/v1.0/parser.go:50-73`: `Parse` accepts an `io.Reader`, decodes from it, and does not close it. Ownership of the opened file is therefore not transferred to `Parse`, leaving the descriptor open until the Go runtime eventually finalizes the file object. With repeated `ParseFile` calls, descriptors can accumulate until the process receives `EMFILE` / "too many open files".

### PoC

[validation-artifact.zip](https://github.com/user-attachments/files/27494463/validation-artifact.zip)

The local artifact `validation-artifact.zip` contains:

- `leak_poc.go`: PoC source that repeatedly calls `schema.ParseFile("schema/v1.0/testdata/valid-example.yaml")` and prints `/proc/self/fd` counts.
- `LEAK_POC_README.txt`: reproduction notes.
- `leak_poc_run.log`: captured attempted run; the local offline environment failed before execution because Go module download from `proxy.golang.org` was forbidden.

Reproduce from the root of a checkout of `pellared/opentelemetry-go` at commit `e72a235` with Go module dependencies already available:

```sh
/bin/sh -c 'ulimit -n 256; GOGC=off go run leak_poc.go'
```

Configuration:

- File descriptor soft limit: `256`
- Garbage collection: disabled with `GOGC=off` so leaked descriptors are not reclaimed during the loop
- Schema file: `schema/v1.0/testdata/valid-example.yaml`

Expected output is increasing descriptor counts followed by an `EMFILE` failure, for example:

```text
iter 0 fds 7
iter 50 fds 57
iter 100 fds 107
...
panic: iteration 248: open schema/v1.0/testdata/valid-example.yaml: too many open files
```

The exact initial descriptor count and failing iteration can vary by OS and process state.

### Impact

This is a file descriptor resource leak leading to availability loss. Applications that call `schema.ParseFile` repeatedly, especially through a runtime reload or request-controlled path, can exhaust their process file descriptor table and fail subsequent file, socket, or other descriptor operations. Impact is limited to denial of service of the consuming process; the evidence does not show confidentiality or integrity impact.

## Affected packages

- `go.opentelemetry.io/otel/schema/v1.1 < 0.0.17`
- `go.opentelemetry.io/otel/schema/v1.0 < 0.0.17`
- `go.opentelemetry.io/otel/schema < 0.0.17`

## Remediation

Upgrade to a patched release:

- `go.opentelemetry.io/otel/schema/v1.1 0.0.17`
- `go.opentelemetry.io/otel/schema/v1.0 0.0.17`
- `go.opentelemetry.io/otel/schema 0.0.17`