# CVE-2026-39882: OpenTelemetry-Go memory exhaustion in OTLP HTTP exporters Source: https://junglewise.ai/threats/cve-2026-39882-opentelemetry-go-memory-exhaustion-in-otlp-http-exporters Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-04-08. Updated: 2026-07-24 License: CC BY 4.0 with a link back CVE-2026-39882 · Severity: medium · CVSS 5.3 · Published 2026-04-08 OpenTelemetry-Go is a library used by developers to monitor application performance and health by sending data to a central collector. A vulnerability in the library's data export component allows a malicious or compromised collector to send back an excessively large response that consumes all available system memory. This can lead to a complete crash of the monitored application, resulting in service outages. Technologies: [Opentelemetry](https://junglewise.ai/threats/technologies/opentelemetry). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Opentelemetry](https://junglewise.ai/threats/vendors/opentelemetry). ## Quick answers **Is CVE-2026-39882 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39882 being exploited in the wild. **How severe is CVE-2026-39882?** Medium severity, with a CVSS score of 5.3, published 8 April 2026. **Which products and versions are affected?** go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go) SEMVER:introduced=0,fixed=0.19.0; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go) SEMVER:introduced=0,fixed=1.43.0; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) SEMVER:introduced=0,fixed=1.43.0; Opentelemetry-Go (Otlploghttp) < 0.19.0; and 2 more. **Is there a fix for CVE-2026-39882?** Yes. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go): upgrade to 0.19.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go): upgrade to 1.43.0 or later; go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.43.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-39882 attacked?** It is attacked from the adjacent network, in a software library. **Am I affected by CVE-2026-39882?** Check whether you run go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go), go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (Go): upgrade to 0.19.0 or later ```sh go get go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0 ``` - go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (Go): upgrade to 1.43.0 or later ```sh go get go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.43.0 ``` - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (Go): upgrade to 1.43.0 or later ```sh go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0 ``` ## Technical details The OTLP HTTP exporters for traces, metrics, and logs in OpenTelemetry-Go fail to cap the size of HTTP response bodies read into memory. Specifically, the library uses io.Copy to read the full response body into an in-memory bytes.Buffer without a size limit. An attacker who controls the collector endpoint, or a network attacker capable of a Man-in-the-Middle (MitM) attack, can return a massive response body to trigger a heap allocation that exceeds available memory. This results in an Out-of-Memory (OOM) crash of the instrumented process. The issue is fixed in version 1.43.0 (and 0.19.0 for the logs exporter) by implementing a response size limit. ## Affected products - OpenTelemetry opentelemetry-go (otlptracehttp) < 1.43.0 - OpenTelemetry opentelemetry-go (otlpmetrichttp) < 1.43.0 - OpenTelemetry opentelemetry-go (otlploghttp) < 0.19.0 ## Identifiers - CVE-2026-39882 - GHSA-w8rr-5gcm-pp58 - GO-2026-4985 ## Timeline - 2026-04-01: patched: Fix merged in pull request #8108 - 2026-04-08: disclosed: Security advisory published by GitHub and OpenTelemetry - 2026-04-08: advisory: CVE-2026-39882 assigned ## References - [https://github.com/open-telemetry/opentelemetry-go/pull/8108](https://github.com/open-telemetry/opentelemetry-go/pull/8108) - [https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58) ## Related threats - [OpenTelemetry-Go endpoint URL logging in TracerProvider diagnostics](https://junglewise.ai/threats/cve-2026-81870-opentelemetry-go-endpoint-url-logging-in-tracerprovider) - [OpenTelemetry .NET has potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path](https://junglewise.ai/threats/cve-2026-41078-opentelemetry-net-has-potential-memory-exhaustion-via-unbounded) - [OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers](https://junglewise.ai/threats/cve-2026-40894-opentelemetry-dotnet-excessive-memory-allocation-when-parsing) - [OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling](https://junglewise.ai/threats/cve-2026-40891-opentelemetry-dotnet-unbounded-grpc-status-details-bin-parsing-in) - [OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies](https://junglewise.ai/threats/cve-2026-40182-opentelemetry-dotnet-otlp-exporter-reads-unbounded-http-response)