Most recent entries from all

fkie_cve-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0.

GHSA-hjf4-fphr-2h65 — OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

Affected: Go: go.opentelemetry.io/otel/sdk/log

### Summary

A `BatchingProcessor` in `go.opentelemetry.io/otel/sdk/log` can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion.

Introduced in commit: 4af9c20

### Details

`NewBatchingProcessor` wraps the exporter with `newBufferExporter(exporter, 1)` (`sdk/log/batch.go:116-122`), so the asynchronous export input can fill quickly when the downstream exporter blocks. The poll goroutine dequeues a batch with `b.q.TryDequeue`, calls `b.exporter.EnqueueExport(r)`, and then immediately sends on `b.pollTrigger` whenever `qLen >= b.batchSize` (`sdk/log/batch.go:129-165`).

`bufferExporter.EnqueueExport` is non-blocking: it sends to `e.input` if possible and returns `false` in the `default` case when the channel is full (`sdk/log/exporter.go:221-248`). `TryDequeue` leaves `q.len` unchanged when the write callback returns `false` (`sdk/log/batch.go:289-314`). Therefore, while the exporter is backpressured, `EnqueueExport` fails, the queue remains at or above one full batch, and the poll loop continuously retriggers itself without waiting for the ticker.

### PoC

[validation-artifact.zip](https://github.com/user-attachments/files/27494002/validation-artifact.zip)

The validation artifact contains a PoC bundle:

- `validation-artifact.tar:main.go`: PoC source. - `…

msrc_CVE-2026-81872 — OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

msrc_CVE-2026-81872

openSUSE-SU-2026:11872-1 — distribution-registry-3.1.1-8.1 on GA media

distribution-registry-3.1.1-8.1 on GA media

RHSA-2026:68272 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

UBUNTU-CVE-2026-81872

Affected: Ubuntu:22.04:LTS: golang-opentelemetry-otel, Ubuntu:24.04:LTS: golang-opentelemetry-otel, Ubuntu:26.04:LTS: golang-opentelemetry-otel