Executive brief
OpenTelemetry-Go's logging SDK can be forced into a resource-exhaustion state when attackers send high volumes of log messages while the exporter is slow or blocked. The logging processor enters a tight CPU loop repeatedly retrying without waiting, causing service degradation or denial of service in applications using this library. This impacts any system relying on OpenTelemetry for observability and log collection.
Technical details
The vulnerability is a denial-of-service condition in the BatchingProcessor's polling architecture (prior to version 0.21.0). The root cause is a tight retry loop in the poll goroutine that repeatedly checks queue.TryDequeue and bufferExporter.EnqueueExport without waiting for a scheduled interval when the export buffer is full and unable to accept more requests. When attacker-driven log emission fills the asynchronous export buffer while an exporter is backpressured (slow or blocked), the processor continuously signals itself instead of waiting for the next tick, causing CPU exhaustion. No authentication or special privileges are required—any process that can trigger log emission can trigger this condition. The vulnerability was fixed in version 0.21.0 by redesigning the processor to use a single worker goroutine that owns dequeueing and exporter calls, eliminating the no-progress retry path.
Affected products
- OpenTelemetry OpenTelemetry-Go prior to 0.21.0
Timeline
- 2026-09-16: disclosed
- 2026-07-24: patched: Fix released in version 0.21.0