Bug 2535727 (CVE-2026-81872)

Summary: CVE-2026-81872 go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, amctagga, anjoseph, anpicker, aoconnor, aos-team-art-private, asdas, bniver, bparees, bsquizza, cahl, cmitchel, crizzo, doconnor, dpaolell, eglynn, elicohen, flucifre, gbenhaim, gmeno, gparvin, groman, gtanzill, hasun, jbalunas, jbuscemi, jcantril, jdelft, jfula, jjoyce, jowilson, jprabhak, jpretori, jschluet, jupierce, lchilton, lgamliel, lgarciaa, lhh, ljawale, mbenjamin, mbiarnes, mburns, mgarciac, mhackett, msilmser, mwringe, niyer, nyancey, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rhaigner, rhel-process-autobot, rojacob, sbratsla, sdawley, sfeifer, sghai, sidsharm, sostapov, suppawar, syedriko, teagle, tsze, twaugh, tzivkovi, vereddy, vlaad, watson-tool-maintainers, wtam, xdharmai
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the OpenTelemetry-Go `BatchingProcessor` component. A remote attacker can exploit this by sending a high volume of log emissions, which can fill the asynchronous export buffer. This causes the processor to enter a tight CPU loop, repeatedly retrying to export logs without proper waiting mechanisms. The consequence is the exhaustion of CPU resources, leading to a degradation or denial of service (DoS) in the affected application.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2536941, 2536942, 2536943, 2536945, 2536946, 2536947, 2536948, 2536940, 2536944    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-16 21:13:31 UTC 
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when attacker-driven log emission fills its asynchronous export buffer while the exporter is backpressured. NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop calls queue.TryDequeue and bufferExporter.EnqueueExport before immediately signaling pollTrigger whenever the queue remains at or above batchSize. Because a failed nonblocking EnqueueExport leaves the queue length unchanged, the processor repeatedly retries without waiting for its ticker, exhausting CPU and degrading or denying service in the embedding process. This issue is fixed in version 0.21.0.