1vulnerability
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate1 (100.0%)
- Low0 (0.0%)
opentelemetry-instrumentation-oracledb
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 1ModerateAffects 1 version
- 0LowAffects 0 versions
Monthly breakdown
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting opentelemetry-instrumentation-oracledb, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-qqmp-wf37-98f9 | Moderate | Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute### Impact Multiple `@opentelemetry/instrumentation-*` packages recorded the database connection username as the `db.user` span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by `enhancedDatabaseReporting` or any other opt-in flag, and it was the **default** behaviour for all users of the affected packages until the patched releases shipped on 2026-07-23. The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention i |
| GitHub (opens in a new tab) |
- GHSA-qqmp-wf37-98f9ModerateMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
< 0.46.0
### Impact Multiple `@opentelemetry/instrumentation-*` packages recorded the database connection username as the `db.user` span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by `enhancedDatabaseReporting` or any other opt-in flag, and it was the **default** behaviour for all users of the affected packages until the patched releases shipped on 2026-07-23. The attribute is forwarded to every configured observability backend (Jaeger, Zipkin, Datadog, OTLP collectors, etc.). Depending on the database account naming convention i
CVE: CVE-2026-104872