CVE-2026-39882
ADVISORY - githubSummary
overview:
this report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap.
this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).
severity
HIGH
not claiming: this is a remote dos against every default deployment. claiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.
callsite (pinned):
- exporters/otlp/otlptrace/otlptracehttp/client.go:199
- exporters/otlp/otlptrace/otlptracehttp/client.go:230
- exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170
- exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201
- exporters/otlp/otlplog/otlploghttp/client.go:190
- exporters/otlp/otlplog/otlploghttp/client.go:221
permalinks (pinned):
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L201
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L190
- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L221
root cause:
each exporter client reads resp.Body using io.Copy(&respData, resp.Body) into a bytes.Buffer on both success and error paths, with no upper bound.
impact: a malicious collector can force large transient heap allocations during export (peak memory scales with attacker-chosen response size) and can potentially crash the instrumented process (oom).
affected component:
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
- go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
- go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp
repro (local-only):
unzip poc.zip -d poc
cd poc
make canonical resp_bytes=33554432 chunk_delay_ms=0
expected output contains:
[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[PROOF_MARKER]: resp_bytes=33554432 peak_alloc_bytes=118050512
control (same env, patched target):
unzip poc.zip -d poc
cd poc
make control resp_bytes=33554432 chunk_delay_ms=0
expected control output contains:
[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)
[NC_MARKER]: resp_bytes=33554432 peak_alloc_bytes=512232
attachments: poc.zip (attached)
Fixed in: https://github.com/open-telemetry/opentelemetry-go/pull/8108
Common Weakness Enumeration (CWE)
Memory Allocation with Excessive Size Value
Memory Allocation with Excessive Size Value
NIST
1.6
CVSS SCORE
5.3mediumGitHub
1.6
CVSS SCORE
5.3mediumDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumChainguard
CGA-wv7h-52ff-r668
-
minimos
MINI-28ff-prw2-44jh
-
minimos
MINI-295g-m6v3-794h
-
minimos
MINI-2h2q-4x58-2r67
-
minimos
MINI-2q8j-73p2-gp39
-
minimos
MINI-2rhw-mcg8-3vf5
-
minimos
MINI-34gc-jw7v-9hr2
-
minimos
MINI-3638-q844-wcf4
-
minimos
MINI-399j-jm7f-hvfw
-
minimos
MINI-3mqf-6c8v-fj6c
-
minimos
MINI-3p6x-qqh7-645w
-
minimos
MINI-3pmx-v2xw-5g7r
-
minimos
MINI-3qmw-23r6-rqpc
-
minimos
MINI-3v5j-pxph-2vc4
-
minimos
MINI-4cfg-g6j7-m9q8
-
minimos
MINI-4g9j-q39p-cwv4
-
minimos
MINI-4p8m-hj9v-r4h3
-
minimos
MINI-4x2g-p5fp-7hqj
-
minimos
MINI-5744-qmwj-w4qw
-
minimos
MINI-5fvf-4mj8-4hrf
-
minimos
MINI-5vj3-h2qr-9xjw
-
minimos
MINI-5x24-qfw2-3rvp
-
minimos
MINI-6938-cvgh-3pjc
-
minimos
MINI-6r74-8gq2-4fgw
-
minimos
MINI-7527-rv24-frf6
-
minimos
MINI-77p2-xff5-7ccg
-
minimos
MINI-79vp-gwmp-c8xp
-
minimos
MINI-7vv9-cpw2-662m
-
minimos
MINI-85pv-r9p7-5j6w
-
minimos
MINI-88rh-xjq9-2qqr
-
minimos
MINI-8hcf-6pm9-xfvc
-
minimos
MINI-8hjf-95x8-v6j7
-
minimos
MINI-8hpq-prhh-qp9f
-
minimos
MINI-8j5q-q92h-xxg3
-
minimos
MINI-8mq5-r6vx-7gwh
-
minimos
MINI-8qw4-643v-rg4v
-
minimos
MINI-8v46-5j6q-7xvf
-
minimos
MINI-928w-3587-cwff
-
minimos
MINI-9c83-mvcq-4r78
-
minimos
MINI-9gc8-fmgq-5g8r
-
minimos
MINI-9h2c-p72x-5283
-
minimos
MINI-9qgp-fqf4-3r7m
-
minimos
MINI-9xq7-442x-36v3
-
minimos
MINI-c3rr-xxmj-j9h8
-
minimos
MINI-c757-7q38-f2j7
-
minimos
MINI-c7r3-2h2m-6m6p
-
minimos
MINI-f645-xcj6-gq23
-
minimos
MINI-f7vv-9mhv-2h8r
-
minimos
MINI-ffv7-xf2m-3ch3
-
minimos
MINI-fh44-67v6-775j
-
minimos
MINI-fh9h-hrvq-5rwq
-
minimos
MINI-fj45-cxpm-cfh8
-
minimos
MINI-fjx6-jhf7-vp2x
-
minimos
MINI-fpp5-cr72-r94m
-
minimos
MINI-fpw4-437j-hmmf
-
minimos
MINI-fqc2-f93v-5grw
-
minimos
MINI-g7hf-hjcr-2x9h
-
minimos
MINI-g8q7-94ff-8v4j
-
minimos
MINI-gcfr-mhwj-37q9
-
minimos
MINI-gg2p-m3vw-6fvw
-
minimos
MINI-grfq-9g3m-p4gw
-
minimos
MINI-grh5-r8f3-rxmj
-
minimos
MINI-grmc-g887-5847
-
minimos
MINI-hjfq-9799-cf62
-
minimos
MINI-hvfj-j8xp-hf77
-
minimos
MINI-j372-qfjq-4569
-
minimos
MINI-j762-cjg4-vg24
-
minimos
MINI-jjr3-5ccq-rxmr
-
minimos
MINI-jp6w-4j57-q9jx
-
minimos
MINI-jr5c-66m2-7hxf
-
minimos
MINI-jrhf-gmqf-mx44
-
minimos
MINI-jrjj-h68h-rrvg
-
minimos
MINI-jv89-w2v5-mv7r
-
minimos
MINI-jvjx-f2pq-hfm7
-
minimos
MINI-jw83-ccf8-h7fq
-
minimos
MINI-m7mg-g273-hgv9
-
minimos
MINI-m7qr-xj8v-2rpf
-
minimos
MINI-mm6g-7xm3-4w9j
-
minimos
MINI-p3fp-gh5g-mww4
-
minimos
MINI-p8m3-fmjj-m56j
-
minimos
MINI-pg6x-g5x2-r46f
-
minimos
MINI-prfw-xfc3-7hpc
-
minimos
MINI-q33g-wg3h-pf8x
-
minimos
MINI-qhr8-47jj-jqrh
-
minimos
MINI-qp5j-5277-7vh3
-
minimos
MINI-qq9r-9wq7-m55x
-
minimos
MINI-qw72-r22x-65j4
-
minimos
MINI-qx65-f8rg-hhff
-
minimos
MINI-qx6q-mhrm-6369
-
minimos
MINI-r44w-cxwj-53p8
-
minimos
MINI-rc92-g3px-jwff
-
minimos
MINI-rcvf-j3mj-g9m2
-
minimos
MINI-rf2f-fhw3-4476
-
minimos
MINI-rg98-h3w3-26r4
-
minimos
MINI-rgx7-hmw9-g2wp
-
minimos
MINI-rmm6-47rw-h22c
-
minimos
MINI-rqh2-54p5-rrr3
-
minimos
MINI-rxw7-42fh-r5r4
-
minimos
MINI-v6pv-h46x-v4gf
-
minimos
MINI-v947-cf2v-h3q9
-
minimos
MINI-vgqj-38c7-w7qv
-
minimos
MINI-vr3g-q5rc-j7mc
-
minimos
MINI-vvrw-hvm7-7rr7
-
minimos
MINI-w522-6px2-5vjw
-
minimos
MINI-w55v-fj5m-wq2j
-
minimos
MINI-w5g4-prhc-f9qr
-
minimos
MINI-w759-pqc3-w9gg
-
minimos
MINI-wc98-vp7p-h72h
-
minimos
MINI-wv7f-vjhp-w96w
-
minimos
MINI-x3hh-8r88-qr5g
-
minimos
MINI-x5mw-rgv9-r62r
-
minimos
MINI-x6rg-ch8j-532f
-
minimos
MINI-xcfq-hv5w-9hw8
-
minimos
MINI-xhj9-phgh-x726
-
minimos
MINI-xhr3-cqvx-hm55
-
minimos
MINI-xmfc-jrf3-c2jc
-
minimos
MINI-xr9r-wx34-qw9c
-
minimos
MINI-xwg2-74hf-wwp2
-