GO-2026-4985

vendorUSosv

Oversized OTLP HTTP response bodies can cause memory exhaustion in go.opentelemetry.io/otel/exporters/otlp

view advisory published 2026-05-26Licence: per source

The OTLP HTTP exporters (traces, metrics, and logs) do not limit the size of the HTTP response body read from the collector. A malicious or misconfigured collector can send a large response body, leading to excessive memory consumption and potential process termination (OOM).

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-39882US	—	0.19% (9th)	—	2026-04-08
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.…

references

External citations — patches, advisories, analysis.

http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0WEB
https://github.com/open-telemetry/opentelemetry-go/pull/8108FIX
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan