CVE-2026-81872

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions prior to 0.21.0

Description The go.opentelemetry.io/otel/sdk/log BatchingProcessor can enter a tight CPU loop when the asynchronous export buffer is filled by attacker-driven log emission while the exporter is experiencing backpressure (a state where the system cannot keep up with the data being sent). The NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1), and the poll loop executes queue.TryDequeue and bufferExporter.EnqueueExport before signaling pollTrigger whenever the queue is at or above batchSize. Since a failed nonblocking EnqueueExport does not change the queue length, the processor retries continuously without waiting for its ticker, leading to CPU exhaustion and potential denial of service for the embedding process.

Recommendations Update to version 0.21.0.