[SECURITY] Transitive Vulnerabilities In CivetWeb via Prometheus-Cpp

Writing this as a normal bug rather than a vulnerability report because this is a report of issues with a dependency, not a new report of a vulnerability in OpenTelemetry itself.

Background Context

Opening this issue because I began consuming OpenTelemetry for a project, and I'm starting to run into issues flagged by my dependency scanning tools with CivetWeb, consumed by this project by way of prometheus-cpp. I have logged an issue with this repo's maintainers as well, saying more or less the same things I am saying here, with a desire to build awareness as much as I can.
Matching issue in prometheus-cpp

Impact

At this stage, because of these unfixed CVEs, the only way I can use OpenTelemetry in my project is by ensuring I do not build or use the Prometheus exporter whatsoever. If I happened to need to use Prometheus as my exporter, I would not be able to use OpenTelemetry.

Details

Several of the vulnerabilities I've mentioned were already logged in CivetWeb but I've logged a couple myself to make the maintainers aware.

Specifically the issues that have been flagged thus far are:
CVE-2021-44964: Resolvable by updating Lua to v5.4.4+
CVE-2022-28805: Resolvable by updating Lua to v5.4.4+
CVE-2025-55763: Fix seems to exist based on issue discussion but is as yet unreleased
CVE-2026-5789: As yet unfixed in CivetWeb
CVE-2025-57052: Resolvable by updating cJSON to v1.7.19+ (not an issue with live code -- civetweb uses cJSON in example usage code only as far as I can tell, but it does still trip automated security scans. Including for completeness)

Normally, I'd just write this up for CivetWeb, but unfortunately earlier this year the primary maintainer of that library has made statements that suggest we should not expect fixes on any consistent timeframe. Maintainer’s commentary. Looking at my calendar, I don't expect I will have bandwidth to address the dependency updates myself either.

Writing to ask if the maintainers of this repo were aware of these security issues and whether any thought was given to finding a replacement for CivetWeb and/or reconsidering usage of Prometheus in this project.

Start by reviewing the Prometheus exporter dependency path through prometheus-cpp to CivetWeb, along with the listed Lua and cJSON vulnerabilities and the linked prometheus-cpp issue. No source files or tests are named. Done would require a maintainer decision and an agreed scope for dependency updates or replacing the affected exporter dependency.