EUVD-2026-81261Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated and network-influenced (PR:N/AV:N), but AC:H reflects the required exporter-backpressure condition; impact is availability-only and partial (A:L), no confidentiality or integrity effect.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0.
AnalysisAI
CPU exhaustion in the OpenTelemetry-Go sdk/log BatchProcessor (BatchingProcessor built via NewBatchingProcessor) before version 0.21.0 lets attacker-driven, high-volume log emission pin a process's CPU when the wrapped log exporter is simultaneously slow or backpressured. The poll loop repeatedly retries a non-blocking queue dequeue and a failed non-blocking EnqueueExport without waiting on its ticker, because the failed enqueue leaves the queue length unchanged at or above batchSize, producing a tight busy-spin that degrades or denies service in the embedding application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Applies only to applications using go.opentelemetry.io/otel/sdk/log with the BatchProcessor (BatchingProcessor via NewBatchingProcessor) prior to version 0.21.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a moderate, availability-only issue - a CPU busy-spin denial-of-service (CWE-400) in the go.opentelemetry.io/otel/sdk/log BatchProcessor, not a code-execution or data-exposure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade go.opentelemetry.io/otel/sdk/log to v0.21.0 or later (release tag sdk/log/v0.21.0, fix commit ba71b09e6ed272e93a669aeaec1e98b1df4cc582, advisory https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65); the upgrade also deprecates WithExportBufferSize, which no longer has any effect after the fix, so remove or ignore that option. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today