Memory Exhaustion Vulnerability in OpenTelemetry Go Implementation

CVE-2026-39882

What is CVE-2026-39882?

OpenTelemetry-Go, which serves as the Go implementation of OpenTelemetry, contains a vulnerability wherein the otlp HTTP exporters process the entire HTTP response body into an in-memory bytes.Buffer without imposing a size limitation. This flaw can lead to memory exhaustion when the connected collector endpoint is under the control of an attacker or if a network attacker can perform a man-in-the-middle (MITM) attack on the exporter connection. The issue is addressed in version 1.43.0, reinforcing security measures against unauthorized memory consumption.

References