CVE-2026-39882

Published: Apr 8, 2026Modified: Jul 24, 2026

5.3

Vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.6 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

Affected (1)

Products: Opentelemetry: Opentelemetry

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Opentelemetry Opentelemetry	Before 1.43.0

Related CWEs

Memory Allocation with Excessive Size Value

The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (2)

https://github.com/open-telemetry/opentelemetry-go/pull/8108

Source: security-advisories@github.com

Patch

https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58

Source: security-advisories@github.com

Third Party Advisory

Timeline

No history available yet.