Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-81872 EUVD-2026-81261GHSA-hjf4-fphr-2h65GO-2026-6615

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

Published Sep 16, 2026 · Updated Sep 17, 2026 · Assigned by GitHub_M

Vendor: open-telemetry Product: opentelemetry-go Package: azl-otel-collector Package: azurelinux-image-tools Package: dagger Package: datadog-agent-7.77 Package: datadog-agent-7.77-full Package: datadog-agent-7.79 Package: datadog-agent-7.79-full Package: go.opentelemetry.io/otel/sdk/log Package: golang-opentelemetry-otel Package: golang-opentelemetry-otel Package: grafana-12.3 Package: guac Package: guacone Package: kubescape Package: kubescape-operator Package: traefik-3.6 Package: traefik-3.7 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go Ecosystem: Ubuntu Ecosystem: Wolfi

Description

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-go < 0.21.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 golang-opentelemetry-otel 1.46.0-2 —
Debian 13 golang-opentelemetry-otel No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-opentelemetry-otel No fix yet —
Ubuntu 26.04 LTS golang-opentelemetry-otel No fix yet —
Ubuntu 24.04 LTS golang-opentelemetry-otel No fix yet —
Ubuntu 22.04 LTS golang-opentelemetry-otel No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 caddy 2.11.4-0.4.hum1 RHSA-2026:68715
Red Hat Hardened Images 1 distribution 3.1.1-0.2.hum1 RHSA-2026:68716
Red Hat Hardened Images 1 grafana12.4 12.4.10-0.6.hum1 RHSA-2026:68821
Red Hat Hardened Images 1 grafana13.1 13.1.6-0.2.hum1 RHSA-2026:68926
Red Hat Hardened Images 1 grafana13.2 13.2.1-0.5.hum1 RHSA-2026:68778
Red Hat Hardened Images 1 helm3 3.22.0-0.2.hum1 RHSA-2026:68717
Red Hat Hardened Images 1 helm4 4.3.0-0.2.hum1 RHSA-2026:68729
Red Hat Hardened Images 1 jaeger 2.20.0-0.9.hum1 RHSA-2026:68910
Red Hat Hardened Images 1 opentelemetry-collector +2 0.161.0-0.1.hum1 RHSA-2026:68591, RHSA-2026:68290, RHSA-2026:68272
Red Hat Hardened Images 1 opentofu1.12 1.12.6-0.3.hum1 RHSA-2026:68905

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 alloy 1.20.1-150700.15.34.1 SUSE-SU-2026:5203-1
SLES 15 SP7 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLES 15 SP7 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLES 15 SP6 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLES 15 SP6 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLES 15 SP5 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLES 15 SP5 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLES 15 SP4 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLES 15 SP4 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 distribution 3.1.1-160000.4.1 SUSE-SU-2026:23990-1
SLES for SAP 16.0 helm 4.3.0-160000.1.1 SUSE-SU-2026:23984-1
SLES for SAP 15 SP6 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLES for SAP 15 SP6 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLES for SAP 15 SP5 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLES for SAP 15 SP5 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLES for SAP 15 SP4 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLES for SAP 15 SP4 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLES 16.0 distribution 3.1.1-160000.4.1 SUSE-SU-2026:23990-1
SLES 16.0 helm 4.3.0-160000.1.1 SUSE-SU-2026:23984-1
SLE Micro 6.2 helm 4.3.0-160000.1.1 SUSE-SU-2026:23973-1
SLE Micro 6.1 helm 4.3.0-slfo.1.1_1.1 SUSE-SU-2026:24282-1
SLE Micro 5.5 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLE HPC 15 SP5 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLE HPC 15 SP5 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1
SLE HPC 15 SP4 distribution 3.1.2-150400.9.47.1 SUSE-SU-2026:5202-1
SLE HPC 15 SP4 helm 3.22.1-150000.1.104.1 SUSE-SU-2026:5119-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed alloy 1.20.1-1.1 openSUSE-SU-2026:12114-1
openSUSE Tumbleweed distribution 3.1.1-8.1 openSUSE-SU-2026:11872-1
openSUSE Tumbleweed helm 4.3.0-3.1 openSUSE-SU-2026:11875-1
openSUSE Tumbleweed helm3 3.22.0-2.1 openSUSE-SU-2026:11892-1
openSUSE Leap 16.0 distribution 3.1.1-160000.4.1 openSUSE-SU-2026:22010-1
openSUSE Leap 16.0 helm 4.3.0-160000.1.1 openSUSE-SU-2026:21983-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 azl-otel-collector No fix yet —
Azure Linux 3 azurelinux-image-tools 1.7.0-2 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling grafana-12.3 12.3.11-r8 —
Wolfi rolling guac +7 No fix yet —
Wolfi rolling kubescape 4.0.16-r0 —
Wolfi rolling kubescape-operator 0.2.188-r0 —
Wolfi rolling traefik-3.7 3.7.14-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go go.opentelemetry.io/otel/sdk/log < 0.21.0 0.21.0 GHSA-hjf4-fphr-2h65

Advisories 25

References