Go/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp CVE-2026-39882: medium 5.3

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

Action: Upgrade go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to 1.43.0 or later.

go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0

Affected

Fixed versions

Sources

• osv: GHSA-w8rr-5gcm-pp58
• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58
• https://nvd.nist.gov/vuln/detail/CVE-2026-39882
• https://github.com/open-telemetry/opentelemetry-go/pull/8108
• https://github.com/open-telemetry/opentelemetry-go
• http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0

CVE-2026-39882 · published 2026-04-08T19:22:01Z · modified 2026-09-10T03:51:03.562742514Z · JSON