Go/go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp CVE-2026-39882: medium 5.3, EPSS 0.19%

Oversized OTLP HTTP response bodies can cause memory exhaustion in go.opentelemetry.io/otel/exporters/otlp

Action: Upgrade go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to 0.19.0 or later.

go get go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.19.0

Affected

Fixed versions

Sources

• osv: GO-2026-4985
• nvd: CVE-2026-39882
• https://github.com/open-telemetry/opentelemetry-go/pull/8108
• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58
• http://github.com/open-telemetry/opentelemetry-go/releases/tag/v1.43.0

CVE-2026-39882 · published 2026-05-26T22:48:49Z · modified 2026-05-27T14:44:16.320277238Z · JSON