Executive brief
OpenTelemetry-Go is a library used by developers to monitor application performance and health by sending data to a central collector. A vulnerability in the library's data export component allows a malicious or compromised collector to send back an excessively large response that consumes all available system memory. This can lead to a complete crash of the monitored application, resulting in service outages.
Technical details
The OTLP HTTP exporters for traces, metrics, and logs in OpenTelemetry-Go fail to cap the size of HTTP response bodies read into memory. Specifically, the library uses io.Copy to read the full response body into an in-memory bytes.Buffer without a size limit. An attacker who controls the collector endpoint, or a network attacker capable of a Man-in-the-Middle (MitM) attack, can return a massive response body to trigger a heap allocation that exceeds available memory. This results in an Out-of-Memory (OOM) crash of the instrumented process. The issue is fixed in version 1.43.0 (and 0.19.0 for the logs exporter) by implementing a response size limit.
Affected products
- OpenTelemetry opentelemetry-go (otlptracehttp) < 1.43.0
- OpenTelemetry opentelemetry-go (otlpmetrichttp) < 1.43.0
- OpenTelemetry opentelemetry-go (otlploghttp) < 0.19.0
Timeline
- 2026-04-01: patched: Fix merged in pull request #8108
- 2026-04-08: disclosed: Security advisory published by GitHub and OpenTelemetry
- 2026-04-08: advisory: CVE-2026-39882 assigned