go package report

Is go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp safe?

2 known vulnerabilities, worst severity HIGH.

cvss

7.5

how bad it is if exploited, out of 10

epss

1.4%

chance of exploitation in the next 30 days

xyz score

4.2

CyberXYZ composite, out of 10

fig. 01 — GHSA-rcjv-mgp8-qvmr, the advisory selected below

// advisories

GHSA-rcjv-mgp8-qvmr

HIGHCVE-2023-45142

This handler wrapper https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65

Affected: < 0.44.0
Fixed in: 0.44.0
Weakness: CWE-770
Published: 2023-10-16
Source: github

GHSA NVD MITRE reference reference reference reference reference reference reference reference reference

// dependencies

0 direct

// ai model usage

Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.

Checked 2026-09-22 at 00:56 UTC. The most recent advisory here was published 2023-10-16. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp safe? go package security report | CyberXYZ