CVE catalog

CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a siz

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-opentelemetry-otelsid1.46.0-3fixed
Debiangolang-opentelemetry-otelforky1.46.0-2fixed
Debiangolang-opentelemetry-oteltrixie1.31.0-4vulnerable
Debiangolang-opentelemetry-otelbookworm1.1.0-2vulnerable
Cpegolang-opentelemetry-otelNot reportedNot reportedvulnerable
CpeopentelemetryNot reported1.43.0fixed
Susecontainerdlinux micro 6.11.7.29-slfo.1.1_5.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-opentelemetry-otelsourcesid1.43.0-1not yet assignedNot reported[1133077]
Debiangolang-opentelemetry-otelsourceforky1.43.0-1not yet assignedNot reported[1133077]
Debiangolang-opentelemetry-otelsourcetrixie(unfixed)not yet assignedNot reported[1133077]
Debiangolang-opentelemetry-otelsourcebookworm(unfixed)not yet assignedNot reported[1133077]
CpeopentelemetrycpeNot reported1.43.0Not reportedNot reportedNot reported
Susecontainerdrpmlinux micro 6.11.7.29-slfo.1.1_5.1Not reportedSUSE-SU-2026:24381-1Not reported

[Debian bug #1133077]

Notes

[trixie] golang-opentelemetry-otel: Minor issue [bookworm] golang-opentelemetry-otel: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-opentelemetry-otel-dev]Affected

    Source package: [golang-opentelemetry-otel]

    Details (2)

    • 1.1.0-2 · all · bookworm

      Affected

      nvd · golang-opentelemetry-otel · debian · bookworm; nvd · golang-opentelemetry-otel · debian · 12

    • 1.1.0-2 · all · bookworm

      Affected

      nvd · golang-opentelemetry-otel · debian · bookworm; nvd · golang-opentelemetry-otel · debian · 12

[Debian 13 (Trixie)]

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]