Skip to content
Fencer Vulns
medium 6.3

CVE-2026-81872 json

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

published 2026-09-16 53 d ago modified 2026-10-01 38 d ago also GHSA-hjf4-fphr-2h65 , GO-2026-6615 , EUVD-2026-81261

cvss
6.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0.

Patch / fix

  • go go.opentelemetry.io/otel/sdk/log 0.21.0
  • golang-opentelemetry-otel Debian 14 1.46.0-2

debian advisories DEBIAN-CVE-2026-81872

  • grafana13.1 hummingbird 1 13.1.6-0.2.hum1
  • opentofu1.12 hummingbird 1 1.12.6-0.3.hum1
  • jaeger hummingbird 1 2.20.0-0.9.hum1
  • grafana12.4 hummingbird 1 12.4.10-0.6.hum1
  • grafana13.2 hummingbird 1 13.2.1-0.5.hum1
  • helm3 hummingbird 1 3.22.0-0.2.hum1
  • helm4 hummingbird 1 4.3.0-0.2.hum1
  • caddy hummingbird 1 2.11.4-0.4.hum1

red hat advisories RHSA-2026:68926RHSA-2026:68905RHSA-2026:68910RHSA-2026:68821RHSA-2026:68778RHSA-2026:68717

  • helm SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +10 more 3.22.1-150000.1.104.1
  • helm Linux Micro 6.1 4.3.0-slfo.1.1_1.1
  • distribution SLES for SAP applications 16.0, SLES 16.0 3.1.1-160000.4.1
  • helm SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 4.3.0-160000.1.1

suse advisories SUSE-SU-2026:5119-1SUSE-SU-2026:24282-1SUSE-SU-2026:23990-1SUSE-SU-2026:23973-1SUSE-SU-2026:23984-1

  • alloy openSUSE Tumbleweed 1.20.1-1.1
  • distribution openSUSE Leap 16.0 3.1.1-160000.4.1
  • helm openSUSE Leap 16.0 4.3.0-160000.1.1
  • helm3 openSUSE Tumbleweed 3.22.0-2.1
  • distribution openSUSE Tumbleweed 3.1.1-8.1
  • helm openSUSE Tumbleweed 4.3.0-3.1

opensuse advisories openSUSE-SU-2026:12114-1openSUSE-SU-2026:22010-1openSUSE-SU-2026:21983-1openSUSE-SU-2026:11892-1openSUSE-SU-2026:11872-1openSUSE-SU-2026:11875-1

  • azurelinux-image-tools Azure Linux 3.0 1.7.0-2

azure linux advisories AZL-103113

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-81872 updated cvss 5.3

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

  • Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 assisted/agent-preinstall-image-builder-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-loki-rhel9, openshift-logging/loki-rhel9-operator
    affected: no fix planned “Out of support scope”
  • Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator, multiarch-tuning/multiarch-tuning-operator-bundle Red Hat Multicluster Engine for Kubernetes multicluster-engine/maestro-rhel9, multicluster-engine/cloudevents-conductor-rhel9 Red Hat Multicluster Global Hub multicluster-globalhub/multicluster-globalhub-grafana-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Developer Tools and Services helm 3.20.2.1-77.el9
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Lightspeed openshift-lightspeed/otelcol-lightspeed-rhel9, openshift-lightspeed/lightspeed-agentic-rhel9-operator
    affected: no fix available “Fix deferred”
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/acm-grafana-rhel9, rhacm2/multicluster-operators-subscription-rhel9, rhacm2/acm-multicluster-observability-addon-rhel9
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat Ceph Storage 5 rhceph/rhceph-5-dashboard-rhel8 Red Hat Ceph Storage 6 rhceph/rhceph-6-dashboard-rhel9
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 7 rhceph/grafana-rhel9 Red Hat Ceph Storage 8 rhceph/grafana-rhel9
    affected: no fix available “Fix deferred”
  • Red Hat Ceph Storage 9 rhceph/alloy-rhel10, rhceph/grafana-rhel10
    affected: no fix available, no fix planned “Out of support scope”
show 5 more
  • Red Hat Connectivity Link 1 rhcl-1/rhcl-rhel9-operator, rhcl-1/rhcl-operator-bundle, rhcl-tech-preview/mcp-gateway-rhel9, rhcl-tech-preview/mcp-gateway-rhel9-operator Red Hat Edge Manager 1 flightctl 1.2.0-1.el10, rhem/flightctl-api-rhel9, rhem/flightctl-api-rhel10, rhem/flightctl-worker-rhel9, rhem/flightctl-worker-rhel10, rhem/flightctl-db-setup-rhel9, +19 more Red Hat Enterprise Linux 9 opentelemetry-collector, opentelemetry-collector 0.152.1-2.el10_2 Red Hat Enterprise Linux 10 grafana 12.4.3-2.el10, opentelemetry-collector 0.152.1-2.el10_2
    affected: no fix available “Fix deferred”
  • Red Hat Hardened Images opentofu1.11 1.11.14-0.1.hum1
    affected: no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-eval-hub-rhel9 Red Hat OpenShift Container Platform 4 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-helm-rhel9-operator Red Hat OpenShift Container Platform 5 openshift5/oc-mirror-plugin-rhel9, openshift5/ose-helm-rhel9-operator Red Hat OpenShift Dev Spaces devspaces/traefik-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-rhel9, rhosdt/tempo-query-rhel9, rhosdt/tempo-jaeger-query-rhel9, rhosdt/opentelemetry-rhel9-operator, rhosdt/opentelemetry-collector-rhel9, rhosdt/opentelemetry-target-allocator-rhel9 Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9
    +1 more products
    Red Hat OpenStack Platform 18.0 rhoso-operators/openstack-operator-bundle
    affected: no fix available “Fix deferred”
  • Red Hat Hardened Images helm4 4.3.0-0.2.hum1, caddy 2.11.4-0.4.hum1, helm3 3.22.0-0.2.hum1, jaeger 2.20.0-0.9.hum1, distribution 3.1.1-0.2.hum1, grafana13.1 13.1.6-0.2.hum1, +6 more
    fixed: vendor fix RHSA-2026:68715
  • Red Hat Hardened Images loki3.7 3.7.7-0.1.hum1, loki3.6 3.6.16-0.1.hum1, tempo3.0 3.0.3-0.2.hum1, tempo2.10 2.10.8-0.2.hum1
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
52 d ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go go.opentelemetry.io/otel/sdk/log
<0.21.0
0.21.0

Affected products

  • open-telemetry opentelemetry-go

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-834 Excessive Iteration

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.