Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-telemetry | opentelemetry-go | < 1.43.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-opentelemetry-otel | 1.43.0-1 | — |
| Debian 13 | golang-opentelemetry-otel | No fix yet | — |
| Debian 12 | golang-opentelemetry-otel | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 26.04 LTS | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 25.10 | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 24.04 LTS | golang-opentelemetry-otel | No fix yet | — |
| Ubuntu 22.04 LTS | golang-opentelemetry-otel | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
| SLES 15 SP7 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.34.1 | SUSE-SU-2026:3714-1 |
| SLES 15 SP7 | golang-github-prometheus-prometheus | 3.5.4-150100.4.37.2 | SUSE-SU-2026:3714-1 |
| SLES 15 SP7 | grafana | 12.4.5-150200.3.91.1 | SUSE-SU-2026:4600-1, SUSE-SU-2026:3718-1 |
| SLES 15 SP7 | system-user-grafana | 1.0.0-150200.5.8.1 | SUSE-SU-2026:4600-1 |
| SLES 12 SP5 | containerd | 1.7.29-16.119.1 | SUSE-SU-2026:4923-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | containerd | 1.7.29-slfo.1.1_5.1 | SUSE-SU-2026:24381-1 |
| SLE Micro 5.5 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
| SLE Micro 5.4 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
| SLE Micro 5.3 | containerd | 1.7.29-150000.152.1 | SUSE-SU-2026:5201-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-Micro-5 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-alertmanager | 0.28.1-150002.4.14.1 | SUSE-SU-2026:3713-1 |
| SUSE Multi Linux Manager Tools SLE-15 | golang-github-prometheus-prometheus | 3.5.4-150002.3.16.1 | SUSE-SU-2026:4585-1, SUSE-SU-2026:3713-1 |
| SUSE Multi Linux Manager Tools SLE-15 | grafana | 12.4.5-150002.4.24.1 | SUSE-SU-2026:4585-1, SUSE-SU-2026:3713-1 |
| SUSE Multi Linux Manager Tools SLE-15 | mgr-push | 5.2.5-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacecmd | 5.2.10-150002.3.15.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | spacewalk-client-tools | 5.2.7-150002.3.12.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | uyuni-tools | 5.2.17-150002.3.20.1 | SUSE-SU-2026:4585-1 |
| SUSE Multi Linux Manager Tools SLE-15 | venv-salt-minion | 3006.0-150002.5.22.1 | SUSE-SU-2026:4585-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-alertmanager | 0.28.1-150100.4.34.1 | SUSE-SU-2026:3714-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 3.5.4-150000.3.75.1 | SUSE-SU-2026:3714-1 |
| SUSE Manager Client Tools 15 | grafana | 12.4.5-150000.1.98.1 | SUSE-SU-2026:3714-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grafana | 12.4.5-4.1 | openSUSE-SU-2026:11619-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 16.0 | grafana | 12.4.10-bp160.1.1 | openSUSE-SU-2026:22125-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-cloudwatch-agent | 1.300066.2-2.amzn2023 | ALAS2023-2026-1747 |
| Amazon Linux 2023 | containerd +1 | 2.2.3-1.amzn2023.0.1 | ALAS2023-2026-1606 |
| Amazon Linux 2023 | docker | 25.0.14-1.amzn2023.0.5 | ALAS2023-2026-1659 |
| Amazon Linux 2 | amazon-cloudwatch-agent | 1.300066.2-2.amzn2 | ALAS2-2026-3323 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | azl-otel-collector | No fix yet | — |
| Azure Linux 3 | azurelinux-image-tools | 1.3.0-1 | — |
| Azure Linux 3 | containerd2 | 2.2.4-2 | — |
| Azure Linux 3 | docker-buildx | 0.14.0-11 | — |
| Azure Linux 3 | docker-compose | 2.27.0-9 | — |
| Azure Linux 3 | moby-containerd-cc | 1.7.7-11 | — |
| Azure Linux 3 | moby-engine | 25.0.3-17 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r56 | — |
| Wolfi rolling | amazon-cloudwatch-agent | 1.300067.0-r1 | — |
| Wolfi rolling | argo-workflow-controller-4.0 | 4.0.4-r4 | — |
| Wolfi rolling | argo-workflows-3.7 +1 | 3.7.13-r2 | — |
| Wolfi rolling | argo-workflows-4.0 +1 | 4.0.5-r5 | — |
| Wolfi rolling | aws-otel-collector | 0.47.0-r12 | — |
| Wolfi rolling | bento | 1.17.0-r1 | — |
| Wolfi rolling | buildctl +1 | 0.29.0-r5 | — |
| Wolfi rolling | caddy | 2.11.2-r12 | — |
| Wolfi rolling | cerbos | 0.51.0-r19 | — |
| Wolfi rolling | cilium-1.19 +4 | 1.19.5-r1 | — |
| Wolfi rolling | cloudprober | 0.14.2-r7 | — |
| Wolfi rolling | containerd-1 | 1.7.30-r9 | — |
| Wolfi rolling | containerd-2 | 2.2.2-r9 | — |
| Wolfi rolling | cortex | 1.21.0-r1 | — |
| Wolfi rolling | dagger | 0.20.7-r1 | — |
| Wolfi rolling | dapr-daprd-1.17 | 1.17.5-r0 | — |
| Wolfi rolling | datadog-agent-7.72 +1 | 7.72.4-r29 | — |
| Wolfi rolling | datadog-agent-7.73 +1 | 7.73.3-r22 | — |
| Wolfi rolling | datadog-agent-7.77 +1 | 7.77.3-r4 | — |
| Wolfi rolling | dgraph | 25.3.2-r2 | — |
| Wolfi rolling | distribution +1 | 3.1.0-r2 | — |
| Wolfi rolling | docker-cli-buildx | 0.33.0-r4 | — |
| Wolfi rolling | docker-compose | 5.1.3-r1 | — |
| Wolfi rolling | dockerd-28 | 28.5.2-r26 | — |
| Wolfi rolling | dockerd-29 | 29.4.1-r0 | — |
| Wolfi rolling | envoy-gateway +1 | 1.7.2-r4 | — |
| Wolfi rolling | envoy-ratelimit | 0.0.0_git20260419-r1 | — |
| Wolfi rolling | external-dns-0.21 | 0.21.0-r12 | — |
| Wolfi rolling | falcosidekick | 2.33.0-r5 | — |
| Wolfi rolling | ferretdb | 2.7.0-r14 | — |
| Wolfi rolling | fluent-bit-plugin-loki | 3.7.1-r4 | — |
| Wolfi rolling | flux-2.7 | 2.7.5-r23 | — |
| Wolfi rolling | flux-2.8 | 2.8.8-r6 | — |
| Wolfi rolling | flux-notification-controller | 1.8.3-r3 | — |
| Wolfi rolling | flyte | 1.16.5-r3 | — |
| Wolfi rolling | gatekeeper-3.22 | 3.22.0-r5 | — |
| Wolfi rolling | gitaly-18.10 +2 | 18.10.4-r2 | — |
| Wolfi rolling | gitaly-18.11 +1 | 18.11.2-r2 | — |
| Wolfi rolling | gitaly-18.6 +11 | No fix yet | — |
| Wolfi rolling | gitaly-18.9 +1 | 18.9.6-r2 | — |
| Wolfi rolling | gitlab-kas-18.9 | 18.9.6-r3 | — |
| Wolfi rolling | grafana-12.3 | 12.3.6.01-r4 | — |
| Wolfi rolling | grafana-12.4 | 12.4.2-r9 | — |
| Wolfi rolling | grafana-13.0 | 13.0.1-r4 | — |
| Wolfi rolling | grafana-alloy | 1.15.1-r0 | — |
| Wolfi rolling | grafana-image-renderer | 5.8.0-r1 | — |
| Wolfi rolling | grafana-mimir-3.0 +3 | 3.0.6-r2 | — |
| Wolfi rolling | grafana-pyroscope-1.19 | 1.19.3-r2 | — |
| Wolfi rolling | grafana-rollout-operator | 0.36.1-r4 | — |
| Wolfi rolling | harbor-2.14 +3 | 2.14.3-r8 | — |
| Wolfi rolling | headlamp | 0.41.0-r5 | — |
| Wolfi rolling | hubble | 1.19.4-r3 | — |
| Wolfi rolling | hydra | 26.2.0-r3 | — |
| Wolfi rolling | jaeger-2-jaeger +2 | 2.18.0-r1 | — |
| Wolfi rolling | k6 | 1.7.1-r4 | — |
| Wolfi rolling | keda-2.19 +1 | 2.19.0-r11 | — |
| Wolfi rolling | kiali | 2.24.0-r2 | — |
| Wolfi rolling | knative-eventing-1.21-filter +7 | 1.21.2-r1 | — |
| Wolfi rolling | knative-operator-1.21 +1 | 1.21.1-r11 | — |
| Wolfi rolling | knative-serving-1.21-queue +5 | 1.21.2-r4 | — |
| Wolfi rolling | kots | 1.130.0-r4 | — |
| Wolfi rolling | kserve-qpext | 0.18.0-r1 | — |
| Wolfi rolling | kube-logging-operator | 6.5.0-r0 | — |
| Wolfi rolling | kubeflow-pipelines-apiserver +3 | 2.16.1-r4 | — |
| Wolfi rolling | kubescape | 4.0.5-r0 | — |
| Wolfi rolling | kubescape-operator | 0.2.139-r0 | — |
| Wolfi rolling | kubo | 0.40.1-r9 | — |
| Wolfi rolling | loki-3.6 +3 | 3.6.10-r4 | — |
| Wolfi rolling | net-kourier-1.21 | 1.21.1-r5 | — |
| Wolfi rolling | octo-sts +1 | 0.5.4-r11 | — |
| Wolfi rolling | op-geth | 1.101702.2-r1 | — |
| Wolfi rolling | opa | 1.15.2-r3 | — |
| Wolfi rolling | opa-envoy | 1.15.2-r2 | — |
| Wolfi rolling | opentelemetry-collector-contrib | 0.149.0-r3 | — |
| Wolfi rolling | opentelemetry-operator | 0.148.0-r3 | — |
| Wolfi rolling | opentofu-1.11 | 1.11.6-r4 | — |
| Wolfi rolling | opentofu-1.9 | 1.9.4-r14 | — |
| Wolfi rolling | prometheus-3.10 | 3.10.0-r7 | — |
| Wolfi rolling | prometheus-3.11 | 3.11.1-r1 | — |
| Wolfi rolling | prometheus-3.9 | 3.9.1-r7 | — |
| Wolfi rolling | prometheus-alertmanager | 0.31.1-r7 | — |
| Wolfi rolling | spicedb | 1.53.0-r1 | — |
| Wolfi rolling | splunk-otel-collector +1 | 0.150.0-r0 | — |
| Wolfi rolling | tekton-pipelines-events-1.11 +5 | 1.11.1-r1 | — |
| Wolfi rolling | teleport-18.6 | 18.6.8-r14 | — |
| Wolfi rolling | teleport-18.6-operator | 18.6.8-r11 | — |
| Wolfi rolling | tempo-2.10 +2 | 2.10.4-r0 | — |
| Wolfi rolling | terraform-mcp-server | 0.5.1-r2 | — |
| Wolfi rolling | terragrunt | 1.0.1-r0 | — |
| Wolfi rolling | thanos | 0.41.0-r14 | — |
| Wolfi rolling | tkn | 0.44.1-r5 | — |
| Wolfi rolling | traefik-3.6 | 3.6.14-r1 | — |
| Wolfi rolling | weaviate | 1.36.11-r0 | — |
| Wolfi rolling | zot | 2.1.16-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp | < 0.19.0 | 0.19.0 | GHSA-w8rr-5gcm-pp58 |
| Go | go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp | < 1.43.0 | 1.43.0 | GHSA-w8rr-5gcm-pp58 |
| Go | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp | < 1.43.0 | 1.43.0 | GHSA-w8rr-5gcm-pp58 |
Advisories 16
- SUSE-SU-2026:5201-1 Security update for containerd SUSE / openSUSE Security Updates · Nov 12, 2026
- SUSE-SU-2026:3714-1 Security update for Multi-Linux Manager Monitoring stack SUSE / openSUSE Security Updates · Nov 10, 2026
- SUSE-SU-2026:4923-1 Security update for containerd SUSE / openSUSE Security Updates · Oct 28, 2026
- WID-SEC-2026-2334 Red Hat OpenShift Container Platform (fast-uri,OpenTelemetry-Go) : Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
- SUSE-SU-2026:24381-1 Security update for containerd SUSE / openSUSE Security Updates · Oct 27, 2026
- openSUSE-SU-2026:22125-1 Security update for grafana SUSE / openSUSE Security Updates · Oct 20, 2026
- SUSE-SU-2026:4600-1 Security update for grafana, system-user-grafana SUSE / openSUSE Security Updates · Oct 9, 2026
- SUSE-SU-2026:4585-1 Security update 5.2.1 for Multi-Linux Manager Client Tools SUSE / openSUSE Security Updates · Oct 8, 2026
- openSUSE-SU-2026:11619-1 grafana-12.4.5-4.1 on GA media SUSE / openSUSE Security Updates · Aug 28, 2026
- SUSE-SU-2026:3718-1 Security update for grafana SUSE / openSUSE Security Updates · Aug 26, 2026
- SUSE-SU-2026:3713-1 Security update for Multi-Linux Manager Client Tools - Monitoring stack SUSE / openSUSE Security Updates · Aug 24, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- ALAS2023-2026-1747 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 6, 2026
- ALAS2-2026-3323 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 6, 2026
- ALAS2023-2026-1659 Moderate: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 13, 2026
- ALAS2023-2026-1606 Important: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 9, 2026