CVE-2026-39882High· 7.5▾ TwilightA flaw was found in OpenTelemetry-Go. The otlp HTTP exporters read the full HTTP response body into an in-memory buffer without a size cap. A remote attacker, by controlling the collector endpoint or performing a man-in-the-middle (MITM) a…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
5.3 → 7.5
medium → high
A flaw was found in OpenTelemetry-Go. The otlp HTTP exporters read the full HTTP response body into an in-memory buffer without a size cap. A remote attacker, by controlling the collector endpoint or performing a man-in-the-middle (MITM) attack on the exporter connection, can exploit this to cause memory exhaustion. This vulnerability can lead to a Denial of Service (DoS) for the affected system.
github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading — rated Important by Red Hat. Released 2026-04-08, updated 2026-09-21.
Affected:
Fixed:
Not affected:
For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha values for the release are as fol… https://access.redhat.com/errata/RHSA-2026:54770 For OpenShift Container Platform 4.22 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/
You may download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.
The sha values for the release are as fol… https://access.redhat.com/errata/RHSA-2026:37585
Affected packages:
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp < 1.43.0go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp < 1.43.0go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp < 0.19.0Patched in:
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp 1.43.0go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp 1.43.0go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp 0.19.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56853High· 7.5net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
CVE-2025-11374Medium· 6.5github.com/hashicorp/consul: Consul's KV endpoint is vulnerable to denial of service (CVE-2025-11374)
CVE-2026-39825Medium· 6.5net/http/httputil: golang: net/http/httputil: ReverseProxy forwards hidden query parameters, potentially bypassing security controls (CVE-2…
CVE-2025-69228Medium· 6.8aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request (CVE-2025-69228)
CVE-2025-62426Medium· 6.5vllm: vLLM vulnerable to DoS via large Chat Completion or Tokenization requests with specially crafted `chat_template_kwargs` (CVE-2025-624…
CVE-2026-18618High· 7.5A flaw was found in ml-metadata