Is CVE-2026-39882 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39882 being exploited in the wild.

How severe is CVE-2026-39882?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go) SEMVER:introduced=0,fixed=0.19.0; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go) SEMVER:introduced=0,fixed=1.43.0; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) SEMVER:introduced=0,fixed=1.43.0; Opentelemetry-Go (Otlploghttp) < 0.19.0; and 2 more.

Is there a fix for CVE-2026-39882?

Yes. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go): upgrade to 0.19.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go): upgrade to 1.43.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.43.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39882 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-39882?

Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39882: OpenTelemetry-Go memory exhaustion in OTLP HTTP exporters

Q: Is there a fix for CVE-2026-39882?

Yes. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go): upgrade to 0.19.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go): upgrade to 1.43.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.43.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-39882 attacked?

It is attacked from the adjacent network, in a software library.

Q: Am I affected by CVE-2026-39882?

Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39882 · Severity: medium · CVSS 5.3 · Published 2026-04-08

OpenTelemetry-Go is a library used by developers to monitor application performance and health by sending data to a central collector. A vulnerability in the library's data export component allows a malicious or compromised collector to send back an excessively large response that consumes all available system memory. This can lead to a complete crash of the monitored application, resulting in service outages.

Technologies: Opentelemetry. Vendors: Go, Opentelemetry.

Quick answers

Is CVE-2026-39882 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39882 being exploited in the wild.
How severe is CVE-2026-39882?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go) SEMVER:introduced=0,fixed=0.19.0; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go) SEMVER:introduced=0,fixed=1.43.0; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) SEMVER:introduced=0,fixed=1.43.0; Opentelemetry-Go (Otlploghttp) < 0.19.0; and 2 more.
Is there a fix for CVE-2026-39882?: Yes. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go): upgrade to 0.19.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go): upgrade to 1.43.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.43.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39882 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-39882?: Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go): upgrade to 0.19.0 or later
```
go get go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0
```
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go): upgrade to 1.43.0 or later
```
go get go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.43.0
```
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.43.0 or later
```
go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0
```

Technical details

The OTLP HTTP exporters for traces, metrics, and logs in OpenTelemetry-Go fail to cap the size of HTTP response bodies read into memory. Specifically, the library uses io.Copy to read the full response body into an in-memory bytes.Buffer without a size limit. An attacker who controls the collector endpoint, or a network attacker capable of a Man-in-the-Middle (MitM) attack, can return a massive response body to trigger a heap allocation that exceeds available memory. This results in an Out-of-Memory (OOM) crash of the instrumented process. The issue is fixed in version 1.43.0 (and 0.19.0 for the logs exporter) by implementing a response size limit.

Affected products

OpenTelemetry opentelemetry-go (otlptracehttp) < 1.43.0
OpenTelemetry opentelemetry-go (otlpmetrichttp) < 1.43.0
OpenTelemetry opentelemetry-go (otlploghttp) < 0.19.0

Identifiers

CVE-2026-39882
GHSA-w8rr-5gcm-pp58
GO-2026-4985

Timeline

2026-04-01: patched: Fix merged in pull request #8108
2026-04-08: disclosed: Security advisory published by GitHub and OpenTelemetry
2026-04-08: advisory: CVE-2026-39882 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.