CVE-2026-81872: OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion.
Introduced in commit: 4af9c20
References
- github.com/advisories/GHSA-hjf4-fphr-2h65
- github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582
- github.com/open-telemetry/opentelemetry-go/issues/6797
- github.com/open-telemetry/opentelemetry-go/pull/8620
- github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0
- github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65
- nvd.nist.gov/vuln/detail/CVE-2026-81872
Code Behaviors & Features
Detect and mitigate CVE-2026-81872 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →