EUVD-2026-20628
GHSA-w8rr-5gcm-pp58
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Impact | CVSS 5.3 with vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H indicates adjacent-network attack vector (not remote internet-wide), high complexity (man-in-the-middle or attacker control of collector required), no privileges needed, and high availability impact. The vulnerability is not a default-deployment remote DoS because successful exploitation requires either that the exporter be configured to send to an untrusted endpoint, or a realistic network interception scenario. This substantially lowers the real-world attack surface compared to a high-CVSS internet-facing RCE. However, for users who do configure exporters to send to third-party or semi-trusted collector endpoints (increasingly common in multi-tenant or outsourced telemetry scenarios), this represents a practical availability risk. The provided proof-of-concept demonstrates 118MB peak allocation from a 32MB response, confirming the vulnerability is real and reproducible. No public exploits beyond the POC have been identified, and KEV status is not confirmed; the vulnerability remains pre-active-exploitation stage pending broader awareness. |
| Exploit ScenarioDerived | A developer configures an OpenTelemetry Go application to export traces to a third-party SaaS collector (e.g., a hosted telemetry backend). An attacker either compromises the collector's HTTP endpoint or intercepts traffic via man-in-the-middle and responds to the exporter's HTTP POST with a malicious 200-OK response containing a 2GB body. The unpatched exporter begins reading the response with |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
OpenTelemetry Go OTLP HTTP exporters allow memory exhaustion when sending telemetry to attacker-controlled or network-intercepted collector endpoints. The trace, metric, and log exporters read unbounded HTTP response bodies into in-memory buffers without size limits, enabling an attacker to force large transient heap allocations and crash the instrumented process via out-of-memory conditions. Attack requires network control of the collector endpoint or man-in-the-middle position (CVSS 5.3, CVSS:3.1/AV:A/AC:H). Upstream fix available (PR #8108); no active exploitation confirmed.
RemediationAI
Vendor-released patch: v1.43.0. Upgrade OpenTelemetry Go to version 1.43.0 or later, which implements buffer size limits on HTTP response reads. The upstream fix (GitHub PR #8108) adds explicit bounds checking to prevent unbounded buffer growth. If immediate upgrade is not possible, mitigate by ensuring OTLP exporters only send to trusted, internal collector endpoints over secured network segments; avoid exporting to third-party or internet-accessible endpoints until patched. Additionally, implement network segmentation and TLS mutual authentication (mTLS) to reduce the attack surface for potential man-in-the-middle scenarios. See vendor advisory at https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58 and release notes at https://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in go, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
OpenTelemetry Go's OTLP (OpenTelemetry Protocol) HTTP exporters for traces, metrics, and logs use Go's io.Copy() function to read HTTP response bodies into unbounded bytes.Buffer objects in the client.go files of otlptracehttp, otlpmetrichttp, and otlploghttp packages. This pattern appears on both the success and error code paths, meaning malicious responses are processed identically to legitimate ones. The root cause is classified as CWE-789 (Uncontrolled Memory Allocation), a resource exhaustion vulnerability. When an exporter connects to a collector endpoint, the remote endpoint controls the response size; if that endpoint is compromised or accessible to a network attacker via man-in-the-middle, the attacker can send arbitrarily large response payloads. The exporter will attempt to buffer the entire response in heap memory without any configurable or hard-coded upper limit, leading to uncontrolled memory growth.
Know when Canonical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (https://github.com/open-telemetry/opentelemetry-go).
CVSS VectorVendor: https://github.com/open-telemetry/opentelemetry-go
Lifecycle Timeline
2DescriptionCVE.org
overview: this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.
this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).
severity
HIGH
not claiming: this is a remote dos against every default deployment. claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.
callsite (pinned):
- exporters/otlp/otlptrace/otlptracehttp/client.go:199
- exporters/otlp/otlptrace/otlptracehttp/client.go:230
- exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170
- exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201
- exporters/otlp/otlplog/otlploghttp/client.go:190
- exporters/otlp/otlplog/otlploghttp/client.go:221
permalinks (pinned):
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L201
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L190
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L221
root cause: each exporter client reads resp.Body using io.Copy(&respData, resp.Body) into a bytes.Buffer on both success and error paths, with no upper bound.
impact: a malicious collector can force large transient heap allocations during export (peak memory scales with attacker-chosen response size) and can potentially crash the instrumented process (oom).
affected component:
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
- go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
- go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
repro (local-only):
unzip poc.zip -d poc
cd poc
make canonical resp_bytes=33554432 chunk_delay_ms=0expected output contains:
[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[PROOF_MARKER]: resp_bytes=33554432 peak_alloc_bytes=118050512control (same env, patched target):
unzip poc.zip -d poc
cd poc
make control resp_bytes=33554432 chunk_delay_ms=0expected control output contains:
[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[NC_MARKER]: resp_bytes=33554432 peak_alloc_bytes=512232attachments: poc.zip (attached)
Fixed in: https://github.com/open-telemetry/opentelemetry-go/pull/8108
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Proxy LTS 4.3 | Affected |
| SUSE Manager Server LTS 4.3 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP7 | Affected |
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Client Tools 15 | Affected |
| SUSE Manager Proxy LTS 4.3 | Affected |
| SUSE Manager Proxy LTS 4.3 | Affected |
| SUSE Manager Server LTS 4.3 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
| SUSE Multi Linux Manager Tools SLE-15 | Affected |
Exploit-DB