Package
guacone
Component
go.opentelemetry.io/otel/sdk/log
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Not fixed upstream: CVE-2026-81872 is fixed in go.opentelemetry.io/otel/sdk/log 0.21.0, which requires go.opentelemetry.io/otel/log 0.21.0. That otel/log release removed the Value and KeyValue types. This package depends on github.com/uptrace/opentelemetry-go-extra/otelutil, which still uses the removed types. The newest otelutil release, v0.3.2 (September 2024), has not adopted the replacement API, and neither has its main branch. Until it does, the fixed sdk/log cannot be used in this package. Waiting for the first upstream release containing the fix.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-81872 https://github.com/advisories/GHSA-hjf4-fphr-2h65 https://github.com/open-telemetry/opentelemetry-go/blob/log/v0.21.0/CHANGELOG.md https://github.com/uptrace/opentelemetry-go-extra/blob/main/otelutil/attribute.go#L68
Status