go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration

A flaw was found in OpenTelemetry-Go, specifically within its gRPC log exporter. This vulnerability allows a network attacker to bypass the intended private Certificate Authority CA pinning and mutual Transport Layer Security TLS configurations. The issue arises because the environment-only TLS...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector-k8s: opentelemetry-collector-k8s-0.161.0-0.1.hum1 aarch64, x8664 opentelemetry-collector-k8s-0.161.0-0.1.hum1.src src...

go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission

A flaw was found in the OpenTelemetry-Go BatchingProcessor component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper...

Important: Red Hat Security Advisory: opentelemetry-collector security update

An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers

A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service DoS by sending oversized or invalid baggage headers. The Parse function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when...

RHEL 9 : opentelemetry-collector (RHSA-2026:68527)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:68527 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...

Improper Handling of Unicode Encoding

Overview Affected versions of this package are vulnerable to Improper Handling of Unicode Encoding in the attribute truncation process. An attacker can cause the retention of attribute values exceeding the configured length limit by supplying specially crafted Unicode replacement characters,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BatchingProcessor. An attacker can exhaust CPU resources and degrade or deny service by continuously filling the asynchronous export buffer while the exporter is backpressured...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the sdk/trace.NewTracerProvider. An attacker can obtain sensitive information by accessing info-level diagnostic logs that may include internal collector endpoints and credentials embedded in URLs. Note: This ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the sdk/trace.NewTracerProvider. An attacker can obtain sensitive information by accessing info-level diagnostic logs that may include internal collector endpoints and credentials embedded in URLs. Note: This ...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the sdk/trace.NewTracerProvider. An attacker can obtain sensitive information by accessing info-level diagnostic logs that may include internal collector endpoints and credentials embedded in URLs. Note: This ...

AZL-103056 CVE-2026-81871 affecting package azl-otel-collector 0.127.0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, and related client certificate environment variables through loadEnvTLS into cfg.tlsCfg, but...

AZL-103248 CVE-2026-81869 affecting package opa 0.63.0-5

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...

AZL-103191 CVE-2026-81869 affecting package keda 2.14.1-19

OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.10.0 until 1.33.0, the sdk/trace/span.go attribute truncation path can fail to enforce AttributeValueLengthLimit for string and string-slice attributes containing the valid Unicode replacement character U+FFFD...