Skip to content
Fencer Vulns
medium 5.3

CVE-2026-39882 json

OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies

published 2026-04-08 7 mo ago modified 2026-09-10 1 mo ago also GHSA-w8rr-5gcm-pp58 , GO-2026-4985 , EUVD-2026-20628

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

Patch / fix

  • go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.43.0
  • go go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 1.43.0
  • go go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 0.19.0
  • opentelemetry opentelemetry 1.43.0
  • golang-opentelemetry-otel Debian 14 1.43.0-1

debian advisories DEBIAN-CVE-2026-39882

  • containerd Linux Micro 6.1 1.7.29-slfo.1.1_5.1
  • system-user-grafana SLE Module for Package Hub 15 SP7 1.0.0-150200.5.8.1
  • grafana SLE Module for Package Hub 15 SP7 12.4.10-150200.3.94.3
  • grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
  • mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
  • spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
  • uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
  • venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1

suse advisories SUSE-SU-2026:4923-1SUSE-SU-2026:24381-1SUSE-SU-2026:4600-1SUSE-SU-2026:4585-1SUSE-SU-2026:3718-1SUSE-SU-2026:3714-1

  • grafana openSUSE Leap 16.0 12.4.10-bp160.1.1
  • grafana openSUSE Tumbleweed 12.4.5-4.1
  • govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1

opensuse advisories openSUSE-SU-2026:22125-1openSUSE-SU-2026:11619-1openSUSE-SU-2026:21483-1

  • azurelinux-image-tools Azure Linux 3.0 1.3.0-1
  • containerd2 Azure Linux 3.0 2.2.4-2
  • docker-buildx Azure Linux 3.0 0.14.0-11
  • docker-compose Azure Linux 3.0 2.27.0-9
  • moby-containerd-cc Azure Linux 3.0 1.7.7-11
  • moby-engine Azure Linux 3.0 25.0.3-17

azure linux advisories AZL-82112AZL-82163AZL-82190AZL-82193AZL-82455AZL-82461

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-39882 updated cvss 7.5

github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/maestro-rhel9
    affected: no fix available
  • Red Hat OpenShift Container Platform 4.22 openshift4/ose-thanos-rhel9 1782977513, openshift4/ose-thanos-rhel9 1786549880
    fixed: vendor fix RHSA-2026:54770
  • Red Hat OpenShift Container Platform 4.22 openshift4/frr-rhel9 1783558411, openshift4/frr-rhel9 1786583427, openshift4/ose-cli-rhel9 1786583327, openshift4/ose-pod-rhel9 1786606091, openshift4/ose-etcd-rhel9 1786549839, openshift4/ose-tests-rhel9 1783516858, +218 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
<1.43.0
1.43.0
go go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
<1.43.0
1.43.0
go go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
<0.19.0
0.19.0

Affected products

  • open-telemetry opentelemetry-go

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.