Skip to content
fr Sign in
5.3 Medium

CVE-2026-39882 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

Affected products and versions

Product Affected versions Fixed in
opentelemetry-go 1.43 earliest → < 1.43.0 1.43.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of opentelemetry-go

The 9 CVEs of opentelemetry-go →
CVE-2026-81871 OpenTelemetry-Go is the Go implementation of OpenTelemetry 6.3 Medium CVE-2026-81872 OpenTelemetry-Go is the Go implementation of OpenTelemetry 6.3 Medium CVE-2026-81869 OpenTelemetry-Go is the Go implementation of OpenTelemetry 5.1 Medium CVE-2026-81870 OpenTelemetry-Go is the Go implementation of OpenTelemetry 2.0 Low
Track this CVE