GO-2026-6258: go.opentelemetry.io/otel/bridge/opentracing fixed in 1.45.0

GO-2026-6258 PUBLISHED

Record from OSV · Published August 25, 2026

go.opentelemetry.io/otel/bridge/opentracing is fixed in 1.45.0 (Go Modules)

OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access in go.opentelemetry.io/otel/bridge/opentracing

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
go.opentelemetry.io/otel/bridge/opentracing	Go Modules	1.45.0
cortex	Chainguard	1.21.1-r11
cortex-fips	Chainguard	1.21.1-r10
tempo-2.8	Chainguard	2.8.4-r16
thanos	Chainguard	0.42.4-r4
pulumi-language-yaml	Wolfi	1.38.3-r3
tempo-fips-2.8	Chainguard	2.8.4-r8
thanos-fips	Chainguard	0.42.4-r2
thanos-receive-controller	Chainguard	0_git20260812-r5
thanos-receive-controller-fips	Chainguard	0_git20260812-r3
cortex	Wolfi	1.21.1-r11
pulumi-language-yaml	Chainguard	1.38.3-r3

2 more packages have a fixed version. See every fix in Lookup.

Vendor	Product	Versions
chainguard	cortex	0
chainguard	cortex-fips	0
chainguard	tempo-2.8	0
chainguard	thanos-fips	0
chainguard	thanos-receive-controller	0
chainguard	thanos-receive-controller-fips	0
chainguard	tempo-fips-2.8	0
wolfi	cortex	0
wolfi	pulumi-language-yaml	0
chainguard	thanos	0
chainguard	pulumi-language-yaml	0
wolfi	thanos	0
chainguard	cortex-geomys-fips	0
go.opentelemetry.io	otel/bridge/opentracing	0.11.0

The same record, from the CLI:

vulnetix vdb vuln GO-2026-6258
vulnetix vdb fixes GO-2026-6258

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GO-2026-6258/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart