OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters (traces/metrics/logs) read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can mitm the exporter connection). This vulnerability is fixed in 1.43.0.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade containerd-stressUpgrade amazon-cloudwatch-agentUpgrade docker-debuginfoUpgrade dockerUpgrade containerdUpgrade containerd-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade docker-debuginfoUpgrade docker-debugsourceUpgrade docker | May 19, 2026 | Apr 8, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.8Upgrade Splunk Enterprise to version 9.4.13Upgrade Splunk Enterprise to version 10.2.5Upgrade Splunk Enterprise to version 10.4.1 | Jul 30, 2026 | Apr 8, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub