CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-go/pull/8108	Patch
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-04-08 21:17

Updated : 2026-07-24 21:10

NVD link : CVE-2026-39882

Mitre link : CVE-2026-39882

CVE.ORG link : CVE-2026-39882

JSON object : View

Products Affected

opentelemetry

opentelemetry

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-39882", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39882", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T20:21:49.122499Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-go", "versions": [{"status": "affected", "version": "< 1.43.0"}]}]}], "published": "2026-04-08T21:17:00.547", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-go/pull/8108", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0."}, {"lang": "es", "value": "OpenTelemetry-Go es la implementaci\u00f3n en Go de OpenTelemetry. Antes de la 1.43.0, los exportadores HTTP de otlp (trazas/m\u00e9tricas/registros) le\u00edan el cuerpo completo de la respuesta HTTP en un bytes.Buffer en memoria sin un l\u00edmite de tama\u00f1o. Esto es explotable para el agotamiento de memoria cuando el punto final del recolector configurado est\u00e1 controlado por el atacante (o un atacante de red puede realizar un MitM en la conexi\u00f3n del exportador). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.43.0."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "48C60612-5E76-4FB5-8E3B-070E51A1455B", "versionEndExcluding": "1.43.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}