CVE-2026-39882

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.19%• Percentile: 9%

Techniques & Countermeasures

• CWE-789•Memory Allocation with Excessive Size Value

  The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected Systems

• chainguard•aactl

  < 0.4.12-r56

• chainguard•addon-resizer

  < 0

• chainguard•addon-resizer-fips

  < 0

• chainguard•amazon-cloudwatch-agent

  < 1.300067.0-r1

• chainguard•amazon-cloudwatch-agent-fips

  < 1.300067.0-r2

• chainguard•amazon-eks-ami

  < 0

• chainguard•amazon-eks-ami-fips

  < 0

• chainguard•argo-cd-3.0

  all

• chainguard•argo-cd-3.0-compat

  all

• chainguard•argo-cd-fips-3.0

  < 3.0.23-r9

• chainguard•argo-cd-fips-3.0-compat

  < 3.0.23-r9

• chainguard•argo-events

  < 0

• chainguard•argo-events-fips

  < 0

• chainguard•argo-rollouts

  < 0

• chainguard•argo-workflow-controller-3.7

  < 3.7.13-r2

• chainguard•argo-workflow-controller-4.0

  < 4.0.4-r4

• chainguard•argo-workflow-controller-fips-3.7

  < 3.7.13-r5

• chainguard•argo-workflow-controller-fips-4.0

  < 4.0.4-r5

• chainguard•argo-workflow-executor-3.7

  < 3.7.13-r2

• chainguard•argo-workflow-executor-4.0

  < 4.0.5-r5

• chainguard•argo-workflow-executor-fips-3.7

  < 3.7.13-r5

• chainguard•argo-workflow-executor-fips-4.0

  < 4.0.4-r5

• chainguard•argo-workflows-3.7

  < 3.7.13-r2

• chainguard•argo-workflows-4.0

  < 4.0.5-r5

• chainguard•argo-workflows-fips-3.7

  < 3.7.13-r5

• chainguard•argo-workflows-fips-4.0

  < 4.0.4-r5

• chainguard•auditbeat-8.17

  < 8.17.10-r25

• chainguard•auditbeat-fips-8.17

  < 0

• chainguard•authentik-2025.12-go-server

  all

• chainguard•authentik-2026.2-go-server

  < 0

• chainguard•authentik-fips-2025.12-go-server

  all

• chainguard•authentik-fips-2026.2-go-server

  < 0

• chainguard•aws-fsx-csi-driver

  < 0

• chainguard•aws-fsx-csi-driver-fips

  < 0

• chainguard•aws-otel-collector

  < 0.47.0-r12

• chainguard•aws-otel-collector-fips

  < 0.47.0-r9

• chainguard•azurefile-csi-1.32

  all

• chainguard•azurefile-csi-fips-1.32

  all

• chainguard•bento

  < 1.17.0-r1

• chainguard•bento-fips

  < 1.17.0-r1

• chainguard•blob-csi-1.23

  < 0

• chainguard•blob-csi-1.24

  < 1.24.11-r24 | < 0

• chainguard•blob-csi-fips-1.23

  < 0 | < 1.23.11-r77

• chainguard•blob-csi-fips-1.24

  < 0

• chainguard•buildctl

  < 0.29.0-r5

• chainguard•buildctl-fips

  < 0.29.0-r3

• chainguard•buildkitd

  < 0.29.0-r5

• chainguard•buildkitd-fips

  < 0.29.0-r3

• chainguard•caddy

  < 2.11.2-r12

• chainguard•caddy-fips

  < 2.11.2-r8

Showing first 50 affected entries in server-rendered view.

References (7)

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58
• https://github.com/open-telemetry/opentelemetry-go/pull/8108
• https://github.com/open-telemetry/opentelemetry-go
• http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0
• https://nvd.nist.gov/vuln/detail/CVE-2026-39882
• https://security-tracker.debian.org/tracker/CVE-2026-39882
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39882.json