CVE-2026-39882

OpenTelemetry-Go versions prior to 1.43.0 contain a memory exhaustion vulnerability in the OTLP HTTP exporters for traces, metrics, and logs. The affected exporters read entire HTTP response bodies into memory without implementing a size limit, allowing attackers to trigger denial of service through memory depletion when controlling the collector endpoint or conducting network interception attacks. The vulnerability carries a CVSS score of 5.3 (Medium severity) with an attack vector requiring network adjacency and high attack complexity. It requires no privileges or user interaction and exclusively impacts availability, presenting limited immediate risk in typical deployments. The EPSS score of 0.00007 indicates minimal real-world exploitation likelihood relative to other published vulnerabilities. No active exploitation has been reported, and the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog. Community attention remains low relative to the risk profile, and no publicly disclosed exploit code is available. Organizations should prioritize patching to version 1.43.0 or later as part of standard maintenance schedules, particularly for deployments where external or untrusted parties control collector endpoints.