Vulnerability · Published Sep 16, 2026 · Assigned by GitHub_M
CVE-2026-81872OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
Medium 6.3
In plain English
A medium-severity uncontrolled resource consumption in opentelemetry-go from open-telemetry. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | golang-opentelemetry-otel | no fix listed | DEBIAN-CVE-2026-81872 |
| Debian:14 | golang-opentelemetry-otel | 1.46.0-2 | DEBIAN-CVE-2026-81872 |
| Go | go.opentelemetry.io/otel/sdk/log | 0.21.0 | GHSA-hjf4-fphr-2h65 |
| Go | go.opentelemetry.io/otel/sdk/log | 0.21.0 | GO-2026-6615 |
| Ubuntu:22.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-81872 |
| Ubuntu:24.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-81872 |
| Ubuntu:26.04:LTS | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-81872 |
| Ubuntu:26.10 | golang-opentelemetry-otel | no fix listed | UBUNTU-CVE-2026-81872 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| open-telemetry | opentelemetry-go | < 0.21.0 |
Weakness: CWE-400, CWE-834 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65 x_refsource_CONFIRM
- https://github.com/open-telemetry/opentelemetry-go/issues/6797 x_refsource_MISC
- https://github.com/open-telemetry/opentelemetry-go/pull/8620 x_refsource_MISC
- https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582 x_refsource_MISC
- https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0 x_refsource_MISC