CVE-2026-81872: OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion.
Introduced in commit: 4af9c20
References
- github.com/advisories/GHSA-hjf4-fphr-2h65
- github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582
- github.com/open-telemetry/opentelemetry-go/issues/6797
- github.com/open-telemetry/opentelemetry-go/pull/8620
- github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0
- github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65
- nvd.nist.gov/vuln/detail/CVE-2026-81872
Code Behaviors & Features
Detect and mitigate CVE-2026-81872 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →