UBUNTU-CVE-2026-81871

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

UBUNTU-CVE-2026-81869

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

UBUNTU-CVE-2026-81872

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

GO-2026-6372 vulnerabilities

Vulnerabilities for packages: minio-fips, trufflehog, trufflehog-fips, keda-fips, minio, bento, guac, telegraf, nuclio-controller-fips, bento-fips, keda, argo-events, falcosidekick-fips, versitygw, dapr, nuclio-controller, argo-events-fips, dapr-fips, opentelemetry-collector-contrib,...

GO-2026-6441 vulnerabilities

Vulnerabilities for packages: k8sgpt, knative-eventing, gitlab-workhorse-ce-fips, cloud-provider-azure-fips, ipfs-cluster, k8s-device-plugin, smarter-device-manager, docker, litestream, hydra, calico, cilium, istio, cluster-autoscaler-fips, cerbos, helm, datadog-agent-fips, fleet-server,...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: kube-vip, jobset-fips, terraform-provider-acme-fips, eck-operator-fips, grafana-rollout-operator, kcp, crossplane-provider-aws-elbv2, keda-fips, crossplane-provider-aws-ses-fips, envoy-gateway, hubble-ui-backend-fips, crossplane-provider-aws-rum,...

GO-2026-6348 vulnerabilities

Vulnerabilities for packages: kube-vip, jobset-fips, eck-operator-fips, grafana-rollout-operator, kcp, crossplane-provider-aws-elbv2, keda-fips, crossplane-provider-aws-ses-fips, envoy-gateway, hubble-ui-backend-fips, crossplane-provider-aws-rum, crossplane-provider-aws-timestreamwrite-fips,...

GO-2026-6372 vulnerabilities

Vulnerabilities for packages: keda, dapr, opentelemetry-collector-contrib, telegraf, sftpgo-plugin-pubsub, guac, argo-events, bento, minio, falcosidekick, trufflehog...

GO-2026-6443 vulnerabilities

Vulnerabilities for packages: calico, thanos, kubernetes-csi-external-snapshotter, descheduler, dynamic-localpv-provisioner, fulcio, podman, scorecard, vault-secrets-webhook, openfga, rqlite, crossplane-provider-sql, snyk-cli, trillian, tfsec, mesosphere-vsphere-csi, istio, falco-exporter,...

GO-2026-6348 vulnerabilities

Vulnerabilities for packages: calico, thanos, kubernetes-csi-external-snapshotter, kubernetes-csi-external-attacher, descheduler, dynamic-localpv-provisioner, fulcio, scorecard, vault-secrets-webhook, crossplane-provider-sql, snyk-cli, trillian, tfsec, mesosphere-vsphere-csi, istio, falco-exporte...

CVE-2026-81871 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

CVE-2026-81871

OpenTelemetry-Go prior to version 0.21.0 contains a TLS configuration bug in the exporters/otlp/otlplog/otlploggrpc package. Environment variables for TLS certificates (OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and related client certificate vars) are loaded via loadEnv...

CVE-2026-81871 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

CVE-2026-81871

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

CVE-2026-81871 OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

CVE-2026-81872 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-81872

OpenTelemetry-Go (the Go implementation of OpenTelemetry) has a denial-of-service vulnerability in its go.opentelemetry.io/otel/sdk/log BatchingProcessor . When attacker-driven log emission fills the asynchronous export buffer while the exporter is backpressured, a failed non-blocking EnqueueExpo...

CVE-2026-81872 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...

CVE-2026-81872 OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor...