PT-2026-31449 · Opentelemetry · Opentelemetry-Go
Published
2026-04-01
·
Updated
2026-05-26
·
CVE-2026-39882
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenTelemetry-Go versions prior to 1.43.0
Description
The otlp HTTP exporters (traces, metrics, logs) in OpenTelemetry-Go versions prior to 1.43.0 read the full HTTP response body into an in-memory
bytes.Buffer without a size limit. This can lead to memory exhaustion if the configured collector endpoint is controlled by an attacker, or if a network attacker can perform a man-in-the-middle (mitm) attack on the exporter connection. A malicious collector can force large memory allocations during export, potentially crashing the instrumented process. The vulnerable code is located in the following files: exporters/otlp/otlptrace/otlptracehttp/client.go, exporters/otlp/otlpmetric/otlpmetrichttp/client.go, and exporters/otlp/otlplog/otlploghttp/client.go.Recommendations
Update to OpenTelemetry-Go version 1.43.0 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opentelemetry-Go