{"id":"GHSA-hjf4-fphr-2h65","summary":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full","details":"### Summary\n\nA `BatchingProcessor` in `go.opentelemetry.io/otel/sdk/log` can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion.\n\nIntroduced in commit: 4af9c20\n\n### Details\n\n`NewBatchingProcessor` wraps the exporter with `newBufferExporter(exporter, 1)` (`sdk/log/batch.go:116-122`), so the asynchronous export input can fill quickly when the downstream exporter blocks. The poll goroutine dequeues a batch with `b.q.TryDequeue`, calls `b.exporter.EnqueueExport(r)`, and then immediately sends on `b.pollTrigger` whenever `qLen \u003e= b.batchSize` (`sdk/log/batch.go:129-165`).\n\n`bufferExporter.EnqueueExport` is non-blocking: it sends to `e.input` if possible and returns `false` in the `default` case when the channel is full (`sdk/log/exporter.go:221-248`). `TryDequeue` leaves `q.len` unchanged when the write callback returns `false` (`sdk/log/batch.go:289-314`). Therefore, while the exporter is backpressured, `EnqueueExport` fails, the queue remains at or above one full batch, and the poll loop continuously retriggers itself without waiting for the ticker.\n\n### PoC\n\n[validation-artifact.zip](https://github.com/user-attachments/files/27494002/validation-artifact.zip)\n\nThe validation artifact contains a PoC bundle:\n\n- `validation-artifact.tar:main.go`: PoC source.\n- `validation-artifact.tar:README.md`: build/run notes.\n- `validation-artifact.tar:build_failed.log`: captured build failure from the validation environment.\n\nThe PoC configures a blocking exporter and a `BatchingProcessor` with `WithExportMaxBatchSize(1)`, `WithExportInterval(5*time.Second)`, and `WithMaxQueueSize(2048)`. It emits 1000 records, records a CPU profile for 750 ms while the exporter is blocked, then writes `/workspace/validation_artifacts/busyloop.pprof`.\n\nReproduction steps from an affected checkout at commit `4af9c20`:\n\n```sh\ncd /workspace/opentelemetry-go\ngit checkout 4af9c20\n\nmkdir -p validation_poc/busyloop /workspace/validation_artifacts /tmp/batchingprocessor-busyloop-poc\ntar -xf /path/to/this/finding/validation-artifact.tar -C /tmp/batchingprocessor-busyloop-poc\ncp /tmp/batchingprocessor-busyloop-poc/main.go validation_poc/busyloop/main.go\n\ngo build -o validation_poc/busyloop/busyloop ./validation_poc/busyloop\n./validation_poc/busyloop/busyloop\ngo tool pprof -top /workspace/validation_artifacts/busyloop.pprof\n```\n\nExpected program output:\n\n```text\ncpu profile written to /workspace/validation_artifacts/busyloop.pprof\n```\n\nExpected profile evidence: hot functions should include `(*BatchingProcessor).poll`, `(*queue).TryDequeue`, and `(*bufferExporter).EnqueueExport`, showing repeated export attempts while the exporter is blocked.\n\n\n### Impact\n\nThis is an availability vulnerability: uncontrolled CPU consumption caused by a busy-spin retry loop. Applications using `sdk/log` `BatchingProcessor` are impacted when an attacker can cause sustained log emission and the configured exporter or downstream collector is slow, blocked, or otherwise backpressured. The impact is limited to the embedding process but can degrade or deny service for that application.","aliases":["CVE-2026-81872","GO-2026-6615"],"modified":"2026-10-01T20:56:06.318497338Z","published":"2026-09-29T17:59:53Z","database_specific":{"nvd_published_at":"2026-09-16T21:17:22Z","cwe_ids":["CWE-400","CWE-834"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-09-29T17:59:53Z"},"references":[{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81872"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/issues/6797"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/pull/8620"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582"},{"type":"PACKAGE","url":"https://github.com/open-telemetry/opentelemetry-go"},{"type":"WEB","url":"https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0"}],"affected":[{"package":{"name":"go.opentelemetry.io/otel/sdk/log","ecosystem":"Go","purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.21.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hjf4-fphr-2h65/GHSA-hjf4-fphr-2h65.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}