go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

GO-2026-6505 OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace

OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs in go.opentelemetry.io/otel/exporters/otlp/otlptrace...

CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation

CVE-2026-33701 — Unsafe Deserialization in OpenTelemetry Java Agent RMI Instrumentation Severity: Critical CVSS v4.0: 9.3 Affected versions: opentelemetry-javaagent 2.26.1 Patched in: 2.26.1 released March 23, 2026 Overview OpenTelemetry is probably the most widely adopted observability framework...

CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: authentik-fips, langfuse-fips, foxx-cli, wazuh-dashboard, langfuse, ts-patch, gitlab-rails-ce-fips, opensearch-dashboards-fips, opentelemetry-auto-instrumentations-node, opensearch-dashboards, lerna, dotstatsuite-supercore, actions-runner, nextcloud-server, verdaccio...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: authentik-fips, langfuse-fips, foxx-cli, wazuh-dashboard, langfuse, ts-patch, gitlab-rails-ce-fips, opensearch-dashboards-fips, opentelemetry-auto-instrumentations-node, opensearch-dashboards, lerna, dotstatsuite-supercore, actions-runner, nextcloud-server, verdaccio...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: authentik-fips, langfuse-fips, foxx-cli, wazuh-dashboard, langfuse, ts-patch, gitlab-rails-ce-fips, opensearch-dashboards-fips, opentelemetry-auto-instrumentations-node, opensearch-dashboards, lerna, dotstatsuite-supercore, actions-runner, nextcloud-server, verdaccio...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: authentik-fips, langfuse-fips, foxx-cli, wazuh-dashboard, langfuse, ts-patch, gitlab-rails-ce-fips, opensearch-dashboards-fips, opentelemetry-auto-instrumentations-node, opensearch-dashboards, lerna, dotstatsuite-supercore, actions-runner, nextcloud-server, verdaccio...

CLEANSTART-2026-ST13970 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

Rocky Linux 10.2 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_65116)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202665116 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service vi...

Rocky Linux 10.0 [CIQ] Security Update: opentelemetry-collector (crlsa-2025_16432)

The Rocky Linux 10.0 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202516432 advisory. net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 Tenable has extracted the preceding description block directly from t...

Rocky Linux 10.2 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_34357)

The Rocky Linux 10.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202634357 advisory. github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42154...

Rocky Linux 9 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_19353)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619353 advisory. net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go:...

Rocky Linux 10.0 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2025_7479)

The Rocky Linux 10.0 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257479 advisory. go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-27144 golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in...

Rocky Linux 9 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_65117)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202665117 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 net/mail: golang: Go net/mail: Denial of Service via...

Rocky Linux 9 [CIQ] Security Update: opentelemetry-collector Multiple Vulnerabilities (crlsa-2026_34359)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202634359 advisory. github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint CVE-2026-42154...

SUSE CVE-2026-81870

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.5.0 to 1.44.0, sdk/trace.NewTracerProvider emits a TracerProvider created internal Info-level diagnostic event whose MarshalLog implementations recursively include span processor, exporter, and client configuration...

CLEANSTART-2026-ZE06453 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81871 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

CLEANSTART-2026-YB58885 OpenTelemetry-Go is the Go implementation of OpenTelemetry

CVE-2026-81870 affects multiple packages. OpenTelemetry-Go is the Go implementation of OpenTelemetry. See references for individual vulnerability details...

EUVD-2026-81261

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full...

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

Summary A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries an...