{"id":"GHSA-w8rr-5gcm-pp58","summary":"opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies","details":"overview:\nthis report shows that the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory `bytes.Buffer` without a size cap.\n\nthis is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection).\n\nseverity\n\nHIGH\n\nnot claiming: this is a remote dos against every default deployment.\nclaiming: if the exporter sends traces to an untrusted collector endpoint (or over a network segment where mitm is realistic), that endpoint can crash the process via a large response body.\n\ncallsite (pinned):\n- exporters/otlp/otlptrace/otlptracehttp/client.go:199\n- exporters/otlp/otlptrace/otlptracehttp/client.go:230\n- exporters/otlp/otlpmetric/otlpmetrichttp/client.go:170\n- exporters/otlp/otlpmetric/otlpmetrichttp/client.go:201\n- exporters/otlp/otlplog/otlploghttp/client.go:190\n- exporters/otlp/otlplog/otlploghttp/client.go:221\n\npermalinks (pinned):\n- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L199\n- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlptrace/otlptracehttp/client.go#L230\n- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L170\n- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlpmetric/otlpmetrichttp/client.go#L201\n- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L190\n- https://github.com/open-telemetry/opentelemetry-go/blob/248da958375e4dfb4a1105645107be3ef04b1c59/exporters/otlp/otlplog/otlploghttp/client.go#L221\n\nroot cause:\neach exporter client reads `resp.Body` using `io.Copy(&respData, resp.Body)` into a `bytes.Buffer` on both success and error paths, with no upper bound.\n\nimpact:\na malicious collector can force large transient heap allocations during export (peak memory scales with attacker-chosen response size) and can potentially crash the instrumented process (oom).\n\naffected component:\n- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp\n- go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp\n- go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp\n\nrepro (local-only):\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake canonical resp_bytes=33554432 chunk_delay_ms=0\n```\n\nexpected output contains:\n\n```\n[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)\n[PROOF_MARKER]: resp_bytes=33554432 peak_alloc_bytes=118050512\n```\n\ncontrol (same env, patched target):\n\n```bash\nunzip poc.zip -d poc\ncd poc\nmake control resp_bytes=33554432 chunk_delay_ms=0\n```\n\nexpected control output contains:\n\n```\n[CALLSITE_HIT]: otlptracehttp.UploadTraces::io.Copy(resp.Body)\n[NC_MARKER]: resp_bytes=33554432 peak_alloc_bytes=512232\n```\n\nattachments: poc.zip (attached)\n\n[PR_DESCRIPTION.md](https://github.com/user-attachments/files/25564272/PR_DESCRIPTION.md)\n\n[attack_scenario.md](https://github.com/user-attachments/files/25564273/attack_scenario.md)\n\n[poc.zip](https://github.com/user-attachments/files/25564271/poc.zip)\n\n\nFixed in: https://github.com/open-telemetry/opentelemetry-go/pull/8108","aliases":["CVE-2026-39882","GO-2026-4985"],"modified":"2026-07-17T20:59:33.215593385Z","published":"2026-04-08T19:22:01Z","related":["CVE-2026-44967"],"database_specific":{"cwe_ids":["CWE-789"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-04-08T19:22:01Z","nvd_published_at":"2026-04-08T21:17:00Z"},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39882"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/pull/8108"},{"type":"PACKAGE","url":"https://github.com/open-telemetry/opentelemetry-go"},{"type":"WEB","url":"http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0"}],"affected":[{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp","ecosystem":"Go","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.43.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w8rr-5gcm-pp58/GHSA-w8rr-5gcm-pp58.json"}},{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp","ecosystem":"Go","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.43.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w8rr-5gcm-pp58/GHSA-w8rr-5gcm-pp58.json"}},{"package":{"name":"go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp","ecosystem":"Go","purl":"pkg:golang/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.19.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-w8rr-5gcm-pp58/GHSA-w8rr-5gcm-pp58.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}