go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego

Activity

Latest release: 3y ago
Total releases: 20
Cadence: ~15 days
Last 12 months: 0

Details

First release: Apr 28, 2022

Releases

Version	Released
`v0.43.0` minor	Aug 28, 2023
`v0.42.0` minor	May 23, 2023
`v0.42.0-rc.1` pre	May 17, 2023
`v0.41.1` patch	May 03, 2023
`v0.41.0` minor	Apr 28, 2023
`v0.41.0-rc.2` pre	Mar 23, 2023
`v0.41.0-rc.1` pre	Mar 02, 2023
`v0.40.0` minor	Feb 28, 2023
`v0.39.0` minor	Feb 07, 2023
`v0.38.0` minor 1 CVE	Jan 30, 2023
`v0.37.0` minor	Dec 05, 2022
`v0.36.4` patch	Oct 20, 2022
`v0.36.3` patch	Oct 12, 2022
`v0.36.2` patch	Oct 11, 2022
`v0.36.1` patch	Sep 26, 2022
`v0.36.0` minor	Sep 20, 2022
`v0.35.0` minor	Sep 13, 2022
`v0.34.0` minor	Aug 02, 2022
`v0.33.0` minor	Jul 08, 2022
`v0.32.0` initial	Apr 28, 2022

Dependencies (6)

Depends on

v0.43.0

Used by

Supply-chain exposure

7 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Vulnerable dependencies

1 of 6

github.com/astaxie/beego 3 CVEs

These dependencies are still vulnerable in their latest release. Whether the exact version this package pins is affected isn't checked yet.

Known CVEs (1)

CVE-2023-25151 GHSA-5r5m-65gx-7vrh GO-2023-1546 Feb 08, 2023

otelhttp and otelbeego have DoS vulnerability for high cardinality metrics

7.5 / 10
High
Network Low None None Unchanged None None High

Impact

The v0.38.0 release of go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp uses the httpconv.ServerRequest function to annotate metric measurements for the http.server.request_content_length, http.server.response_content_length, and http.server.duration instruments.

The ServerRequest function sets the http.target attribute value to be the whole request URI (including the query string)^1. The metric instruments do not "forget" previous measurement attributes when cumulative temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack.

Pseudo-attack:

for infinite loop { r := generate_random_string() do_http_request("/some/path?random="+r) }

Patches

go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp - v0.39.0

go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego - v0.39.0

Fixed in

0.39.0

References

https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh
https://nvd.nist.gov/vuln/detail/CVE-2023-25151
https://github.com/open-telemetry/opentelemetry-go-contrib
https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159

Updated Feb 04, 2026 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

minor 11
patch 5
pre 3

20 releases

Release calendar

2023

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More