{"uuid": "2c7a795b-b912-4d2c-94c4-2d15f18d77fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-81872", "type": "seen", "source": "https://gist.github.com/alon710/6253be53c4d49b5dcba96435919c97c0", "content": "# CVE-2026-81872: CVE-2026-81872: CPU Exhaustion via Tight Loop in OpenTelemetry-Go BatchingProcessor\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-81872\n\n## Summary\nAn uncontrolled resource consumption vulnerability in the logs SDK of OpenTelemetry-Go allows remote attackers to trigger a denial of service. Under conditions of downstream exporter backpressure, the BatchingProcessor enters a tight loop, exhausting CPU resources. This occurs because the processor immediately schedules retry attempts without waiting for its ticker interval, spinning continuously when the internal queue remains filled above the batch size. The issue affects all versions prior to v0.21.0 of the go.opentelemetry.io/otel/sdk/log package.\n\n## TL;DR\nA high-severity CPU exhaustion vulnerability in OpenTelemetry-Go's logging SDK allows remote attackers to cause a denial of service via tight-loop execution when downstream exporters experience backpressure.\n\n## Technical Details\n\n- **CWE ID**: CWE-400 (Uncontrolled Resource Consumption), CWE-834 (Excessive Iteration)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 6.3 (Medium)\n- **EPSS Score**: 0.00524 (Percentile: 42.16%)\n- **Impact**: Denial of Service / CPU Exhaustion\n- **Exploit Status**: No weaponized exploits exist in the wild\n- **KEV Status**: Not listed in CISA KEV\n\n## Affected Systems\n\n- Applications running Go services utilizing the OpenTelemetry-Go SDK logs package (go.opentelemetry.io/otel/sdk/log)\n- **go.opentelemetry.io/otel/sdk/log**: < v0.21.0 (Fixed in: `v0.21.0`)\n\n## Mitigation\n\n- Upgrade OpenTelemetry-Go logs SDK to version v0.21.0 or higher\n- Implement strict timeout limits on logging exporters to prevent prolonged backpressure\n- Establish CPU usage alerts on logging microservices to detect abnormal spikes\n\n**Remediation Steps:**\n1. Identify vulnerable dependencies within the Go module files using scanning tools\n2. Update the go.mod dependency: go get go.opentelemetry.io/otel/sdk/log@v0.21.0\n3. Run go mod tidy to clean up dependency configurations\n4. Recompile the application and redeploy to production environments\n\n## References\n\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-81872)\n- [NVD Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-81872)\n- [GitHub Security Advisory](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65)\n- [GitHub Official Pull Request](https://github.com/open-telemetry/opentelemetry-go/pull/8620)\n- [Official Fix Commit](https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582)\n- [Issue Tracker Discussion](https://github.com/open-telemetry/opentelemetry-go/issues/6797)\n- [Vulnerable Component Release Tag](https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0)\n- [Wiz Vulnerability Database](https://www.wiz.io/vulnerability-database/cve/cve-2026-81872)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-81872) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T18:30:31.000000Z"}