OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full
### Summary A `BatchingProcessor` in `go.opentelemetry.io/otel/sdk/log` can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion. Introduced in commit: 4af9c20 ### Details `NewBatchingProcessor` wraps the exporter with `newBufferExporter(exporter, 1)` (`sdk/log/batch.go:116-122`), so the asynchronous export input can fill quickly when the downstream exporter blocks. The poll goroutine dequeues a batch with `b.q.TryDequeue`, calls `b.exporter.EnqueueExport(r)`, and then immediately sends on `b.pollTrigger` whenever `qLen >= b.batchSize` (`sdk/log/batch.go:129-165`). `bufferExporter.EnqueueExport` is non-blocking: it sends to `e.input` if possible and returns `false` in the `default` case when the channel is full (`sdk/log/exporter.go:221-248`). `TryDequeue` leaves `q.len` unchanged when the write callback returns `false` (`sdk/log/batch.go:289-314`). Therefore, while the exporter is backpressured, `EnqueueExport` fails, the queue remains at or above one full batch, and the poll loop continuously retriggers itself without waiting for the ticker. ### PoC [validation-artifact.zip](https://github.com/user-attachments/files/27494002/validation-artifact.zip) The validation artifact contains a PoC bundle: - `validation-artifact.tar:main.go`: PoC source. - `validation
GO-2026-6615
Revision 1
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GO-2026-6615
go.opentelemetry.io/otel/sdk/log
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.21.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.0"
}
]
}
],
"package": {
"name": "go.opentelemetry.io/otel/sdk/log",
"purl": "pkg:golang/go.opentelemetry.io/otel/sdk/log",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://vuln.go.dev/ID/GO-2026-6615.json"
},
"ecosystem_specific": {}
}
]- Related CVEs
- CVE-2026-81872
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #63850 · Revision 1
- Added to Heist Feed
- Publisher date
GHSA-hjf4-fphr-2h65
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-hjf4-fphr-2h65
go.opentelemetry.io/otel/sdk/log
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.21.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.21.0"
}
]
}
],
"package": {
"name": "go.opentelemetry.io/otel/sdk/log",
"purl": "pkg:golang/go.opentelemetry.io/otel/sdk/log",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hjf4-fphr-2h65/GHSA-hjf4-fphr-2h65.json"
}
}
]- Related CVEs
- CVE-2026-81872
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #63937 · Revision 1
- Added to Heist Feed
- Publisher date