Withdrawn by the publisher.

Affected: CleanStart: opentelemetry-collector-contrib

Package opentelemetry-collector-contrib version 0.153.0-r1 fixes 6 vulnerabilities: CVE-2026-2303, ghsa-cp6g-7hqx-qxhp, CVE-2026-45287, ghsa-995v-fvrw-c78m, CVE-2026-48496...

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.

Affected: Go: go.opentelemetry.io/otel/schema/v1.1, Go: go.opentelemetry.io/otel/schema/v1.0, Go: go.opentelemetry.io/otel/schema

### Summary

`go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. The severity is low because exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path.

Introduced in commit: e72a235

### Details

In `schema/v1.0/parser.go:41-47`, `ParseFile` opens the requested schema path with `os.Open` and then returns `Parse(file)` without a `defer file.Close()` or other close path:

```go file, err := os.Open(schemaFilePath) if err != nil { return nil, err } return Parse(file) ```

The validation evidence also identifies `schema/v1.0/parser.go:50-73`: `Parse` accepts an `io.Reader`, decodes from it, and does not close it. Ownership of the opened file is therefore not transferred to `Parse`, leaving the descriptor open until the Go runtime eventually finalizes the file object. With repeated `ParseFile` calls, descriptors can accumulate until the process receives `EMFILE` / "too many open files".

### PoC

[validation-artifact.zip](https://github.com/user-attachments/files/27494463/validation-artifact.zip)

The local artifact `validation-artifact.zip` contains:

- `leak_poc.go`: PoC source that repeatedly calls `schema.ParseFile("schema/v1.0/testdata…

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak

Affected: Ubuntu:22.04:LTS: golang-opentelemetry-otel, Ubuntu:24.04:LTS: golang-opentelemetry-otel, Ubuntu:25.10: golang-opentelemetry-otel, Ubuntu:26.04:LTS: golang-opentelemetry-otel

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1` leaks one file descriptor on each successful `ParseFile` call. `ParseFile` opens the schema file and passes it to `Parse` without closing it; repeated parsing in a long-running process can exhaust the process file descriptor limit and cause denial of service. Exploitation depends on a consuming application exposing repeated schema parsing to an attacker-controlled path. Version 0.0.17 contains a patch for the issue.