Medium severity · published Sep 16, 2026
CVE-2026-81872
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opentelemetry-go · open-telemetry
< 0.21.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-81872
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-81872
github.com
https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582
github.com
https://github.com/open-telemetry/opentelemetry-go/issues/6797
github.com
https://github.com/open-telemetry/opentelemetry-go/pull/8620
github.com
https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0
github.com
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65
More from opentelemetry-go
7.5
CVE-2026-29181
OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)
7.0
CVE-2026-39883
OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking
7.0
CVE-2026-24051
OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
6.3
CVE-2026-81871
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning
5.9
CVE-2026-45404
OpenTelemetry-Go: Unsynchronized baggage map can panic under concurrent access
