{
  "threat_severity" : "Important",
  "public_date" : "2026-04-08T20:24:19Z",
  "bugzilla" : {
    "description" : "github.com/open-telemetry/opentelemetry-go: golang: OpenTelemetry-Go: Memory exhaustion via uncapped HTTP response body reading",
    "id" : "2456727",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2456727"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-770",
  "details" : [ "OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.", "A flaw was found in OpenTelemetry-Go. The otlp HTTP exporters read the full HTTP response body into an in-memory buffer without a size cap. A remote attacker, by controlling the collector endpoint or performing a man-in-the-middle (MITM) attack on the exporter connection, can exploit this to cause memory exhaustion. This vulnerability can lead to a Denial of Service (DoS) for the affected system." ],
  "statement" : "This Important flaw in OpenTelemetry-Go's OTLP HTTP exporters can lead to a denial of service in Red Hat products, such as OpenShift Container Platform and Multicluster Engine for Kubernetes, that utilize OpenTelemetry-Go for telemetry collection. The vulnerability arises from the exporters reading HTTP response bodies into an unbounded in-memory buffer, allowing a remote attacker to exhaust system memory if they control the collector endpoint or perform a Man-in-the-Middle attack on the connection.",
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-07-14T00:00:00Z",
    "advisory" : "RHSA-2026:37585",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-thanos-rhel9:1782977513"
  } ],
  "package_state" : [ {
    "product_name" : "Multicluster Engine for Kubernetes",
    "fix_state" : "Under investigation",
    "package_name" : "multicluster-engine/maestro-rhel9",
    "cpe" : "cpe:/a:redhat:multicluster_engine"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-39882\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-39882\nhttps://github.com/open-telemetry/opentelemetry-go/pull/8108\nhttps://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58" ],
  "name" : "CVE-2026-39882",
  "csaw" : false
}