chore(all): update module go.opentelemetry.io/otel/sdk/log to v0.21.0 [SECURITY] - autoclosed

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
go.opentelemetry.io/otel/sdk/log	v0.19.0 → v0.21.0

---

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

CVE-2026-81872 / GHSA-hjf4-fphr-2h65

More information

Details

Summary

A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion.

Introduced in commit: 4af9c20

Details

NewBatchingProcessor wraps the exporter with newBufferExporter(exporter, 1) (sdk/log/batch.go:116-122), so the asynchronous export input can fill quickly when the downstream exporter blocks. The poll goroutine dequeues a batch with b.q.TryDequeue, calls b.exporter.EnqueueExport(r), and then immediately sends on b.pollTrigger whenever qLen >= b.batchSize (sdk/log/batch.go:129-165).

bufferExporter.EnqueueExport is non-blocking: it sends to e.input if possible and returns false in the default case when the channel is full (sdk/log/exporter.go:221-248). TryDequeue leaves q.len unchanged when the write callback returns false (sdk/log/batch.go:289-314). Therefore, while the exporter is backpressured, EnqueueExport fails, the queue remains at or above one full batch, and the poll loop continuously retriggers itself without waiting for the ticker.

PoC

validation-artifact.zip

The validation artifact contains a PoC bundle:

• validation-artifact.tar:main.go: PoC source.
• validation-artifact.tar:README.md: build/run notes.
• validation-artifact.tar:build_failed.log: captured build failure from the validation environment.

The PoC configures a blocking exporter and a BatchingProcessor with WithExportMaxBatchSize(1), WithExportInterval(5*time.Second), and WithMaxQueueSize(2048). It emits 1000 records, records a CPU profile for 750 ms while the exporter is blocked, then writes /workspace/validation_artifacts/busyloop.pprof.

Reproduction steps from an affected checkout at commit 4af9c20:

cd /workspace/opentelemetry-go
git checkout 4af9c20

mkdir -p validation_poc/busyloop /workspace/validation_artifacts /tmp/batchingprocessor-busyloop-poc
tar -xf /path/to/this/finding/validation-artifact.tar -C /tmp/batchingprocessor-busyloop-poc
cp /tmp/batchingprocessor-busyloop-poc/main.go validation_poc/busyloop/main.go

go build -o validation_poc/busyloop/busyloop ./validation_poc/busyloop
./validation_poc/busyloop/busyloop
go tool pprof -top /workspace/validation_artifacts/busyloop.pprof

Expected program output:

cpu profile written to /workspace/validation_artifacts/busyloop.pprof

Expected profile evidence: hot functions should include (*BatchingProcessor).poll, (*queue).TryDequeue, and (*bufferExporter).EnqueueExport, showing repeated export attempts while the exporter is blocked.

Impact

This is an availability vulnerability: uncontrolled CPU consumption caused by a busy-spin retry loop. Applications using sdk/log BatchingProcessor are impacted when an attacker can cause sustained log emission and the configured exporter or downstream collector is slow, blocked, or otherwise backpressured. The impact is limited to the embedding process but can degrade or deny service for that application.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65
• https://nvd.nist.gov/vuln/detail/CVE-2026-81872
• https://github.com/open-telemetry/opentelemetry-go/issues/6797
• https://github.com/open-telemetry/opentelemetry-go/pull/8620
• https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582
• https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0
• https://github.com/advisories/GHSA-hjf4-fphr-2h65

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

open-telemetry/opentelemetry-go (go.opentelemetry.io/otel/sdk/log)

v0.20.0

Compare Source

Added

• The OTLP exporter now has two new convenience functions, NewExportPipeline and InstallNewPipeline, setup and install the exporter in tracing and metrics pipelines. (#​1373)
• Adds semantic conventions for exceptions. (#​1492)
• Added Jaeger Environment variables: OTEL_EXPORTER_JAEGER_AGENT_HOST, OTEL_EXPORTER_JAEGER_AGENT_PORT
  These environment variables can be used to override Jaeger agent hostname and port (#​1752)
• Option ExportTimeout was added to batch span processor. (#​1755)
• trace.TraceFlags is now a defined type over byte and WithSampled(bool) TraceFlags and IsSampled() bool methods have been added to it. (#​1770)
• The Event and Link struct types from the go.opentelemetry.io/otel package now include a DroppedAttributeCount field to record the number of attributes that were not recorded due to configured limits being reached. (#​1771)
• The Jaeger exporter now reports dropped attributes for a Span event in the exported log. (#​1771)
• Adds test to check BatchSpanProcessor ignores OnEnd and ForceFlush post Shutdown. (#​1772)
• Extract resource attributes from the OTEL_RESOURCE_ATTRIBUTES environment variable and merge them with the resource.Default resource as well as resources provided to the TracerProvider and metric Controller. (#​1785)
• Added WithOSType resource configuration option to set OS (Operating System) type resource attribute (os.type). (#​1788)
• Added WithProcess* resource configuration options to set Process resource attributes. (#​1788)
  • process.pid
  • process.executable.name
  • process.executable.path
  • process.command_args
  • process.owner
  • process.runtime.name
  • process.runtime.version
  • process.runtime.description
• Adds k8s.node.name and k8s.node.uid attribute keys to the semconv package. (#​1789)
• Added support for configuring OTLP/HTTP and OTLP/gRPC Endpoints, TLS Certificates, Headers, Compression and Timeout via Environment Variables. (#​1758, #​1769 and #​1811)
  • OTEL_EXPORTER_OTLP_ENDPOINT
  • OTEL_EXPORTER_OTLP_TRACES_ENDPOINT
  • OTEL_EXPORTER_OTLP_METRICS_ENDPOINT
  • OTEL_EXPORTER_OTLP_HEADERS
  • OTEL_EXPORTER_OTLP_TRACES_HEADERS
  • OTEL_EXPORTER_OTLP_METRICS_HEADERS
  • OTEL_EXPORTER_OTLP_COMPRESSION
  • OTEL_EXPORTER_OTLP_TRACES_COMPRESSION
  • OTEL_EXPORTER_OTLP_METRICS_COMPRESSION
  • OTEL_EXPORTER_OTLP_TIMEOUT
  • OTEL_EXPORTER_OTLP_TRACES_TIMEOUT
  • OTEL_EXPORTER_OTLP_METRICS_TIMEOUT
  • OTEL_EXPORTER_OTLP_CERTIFICATE
  • OTEL_EXPORTER_OTLP_TRACES_CERTIFICATE
  • OTEL_EXPORTER_OTLP_METRICS_CERTIFICATE
• Adds otlpgrpc.WithTimeout option for configuring timeout to the otlp/gRPC exporter. (#​1821)

Fixed

• The Span.IsRecording implementation from go.opentelemetry.io/otel/sdk/trace always returns false when not being sampled. (#​1750)
• The Jaeger exporter now correctly sets tags for the Span status code and message.
  This means it uses the correct tag keys ("otel.status_code", "otel.status_description") and does not set the status message as a tag unless it is set on the span. (#​1761)
• The Jaeger exporter now correctly records Span event's names using the "event" key for a tag.
  Additionally, this tag is overridden, as specified in the OTel specification, if the event contains an attribute with that key. (#​1768)
• Zipkin Exporter: Ensure mapping between OTel and Zipkin span data complies with the specification. (#​1688)
• Fixed typo for default service name in Jaeger Exporter. (#​1797)
• Fix flaky OTLP for the reconnnection of the client connection. (#​1527, #​1814)

Changed

• Span RecordError now records an exception event to comply with the semantic convention specification. (#​1492)
• Jaeger exporter was updated to use thrift v0.14.1. (#​1712)
• Migrate from using internally built and maintained version of the OTLP to the one hosted at go.opentelemetry.io/proto/otlp. (#​1713)
• Migrate from using github.com/gogo/protobuf to google.golang.org/protobuf to match go.opentelemetry.io/proto/otlp. (#​1713)
• The storage of a local or remote Span in a context.Context using its SpanContext is unified to store just the current Span.
  The Span's SpanContext can now self-identify as being remote or not.
  This means that "go.opentelemetry.io/otel/trace".ContextWithRemoteSpanContext will now overwrite any existing current Span, not just existing remote Spans, and make it the current Span in a context.Context. (#​1731)
• Improve OTLP/gRPC exporter connection errors. (#​1737)
• Information about a parent span context in a "go.opentelemetry.io/otel/export/trace".SpanSnapshot is unified in a new Parent field.
  The existing ParentSpanID and HasRemoteParent fields are removed in favor of this. (#​1748)
• The ParentContext field of the "go.opentelemetry.io/otel/sdk/trace".SamplingParameters is updated to hold a context.Context containing the parent span.
  This changes it to make SamplingParameters conform with the OpenTelemetry specification. (#​1749)
• Updated Jaeger Environment Variables: JAEGER_ENDPOINT, JAEGER_USER, JAEGER_PASSWORD
  to OTEL_EXPORTER_JAEGER_ENDPOINT, OTEL_EXPORTER_JAEGER_USER, OTEL_EXPORTER_JAEGER_PASSWORD
  in compliance with OTel spec (#​1752)
• Modify BatchSpanProcessor.ForceFlush to abort after timeout/cancellation. (#​1757)
• The DroppedAttributeCount field of the Span in the go.opentelemetry.io/otel package now only represents the number of attributes dropped for the span itself.
  It no longer is a conglomerate of itself, events, and link attributes that have been dropped. (#​1771)
• Make ExportSpans in Jaeger Exporter honor context deadline. (#​1773)
• Modify Zipkin Exporter default service name, use default resouce's serviceName instead of empty. (#​1777)
• The go.opentelemetry.io/otel/sdk/export/trace package is merged into the go.opentelemetry.io/otel/sdk/trace package. (#​1778)
• The prometheus.InstallNewPipeline example is moved from comment to example test (#​1796)
• The convenience functions for the stdout exporter have been updated to return the TracerProvider implementation and enable the shutdown of the exporter. (#​1800)
• Replace the flush function returned from the Jaeger exporter's convenience creation functions (InstallNewPipeline and NewExportPipeline) with the TracerProvider implementation they create.
  This enables the caller to shutdown and flush using the related TracerProvider methods. (#​1822)
• Updated the Jaeger exporter to have a default enpoint, http://localhost:14250, for the collector. (#​1824)
• Changed the function WithCollectorEndpoint in the Jaeger exporter to no longer accept an endpoint as an argument.
  The endpoint can be passed with the CollectorEndpointOption using the WithEndpoint function or by setting the OTEL_EXPORTER_JAEGER_ENDPOINT environment variable value appropriately. (#​1824)
• The Jaeger exporter no longer batches exported spans itself, instead it relies on the SDK's BatchSpanProcessor for this functionality. (#​1830)
• The Jaeger exporter creation functions (NewRawExporter, NewExportPipeline, and InstallNewPipeline) no longer accept the removed Option type as a variadic argument. (#​1830)

Removed

• Removed Jaeger Environment variables: JAEGER_SERVICE_NAME, JAEGER_DISABLED, JAEGER_TAGS
  These environment variables will no longer be used to override values of the Jaeger exporter (#​1752)
• No longer set the links for a Span in go.opentelemetry.io/otel/sdk/trace that is configured to be a new root.
  This is unspecified behavior that the OpenTelemetry community plans to standardize in the future.
  To prevent backwards incompatible changes when it is specified, these links are removed. (#​1726)
• Setting error status while recording error with Span from oteltest package. (#​1729)
• The concept of a remote and local Span stored in a context is unified to just the current Span.
  Because of this "go.opentelemetry.io/otel/trace".RemoteSpanContextFromContext is removed as it is no longer needed.
  Instead, "go.opentelemetry.io/otel/trace".SpanContextFromContex can be used to return the current Span.
  If needed, that Span's SpanContext.IsRemote() can then be used to determine if it is remote or not. (#​1731)
• The HasRemoteParent field of the "go.opentelemetry.io/otel/sdk/trace".SamplingParameters is removed.
  This field is redundant to the information returned from the Remote method of the SpanContext held in the ParentContext field. (#​1749)
• The trace.FlagsDebug and trace.FlagsDeferred constants have been removed and will be localized to the B3 propagator. (#​1770)
• Remove Process configuration, WithProcessFromEnv and ProcessFromEnv, and type from the Jaeger exporter package.
  The information that could be configured in the Process struct should be configured in a Resource instead. (#​1776, #​1804)
• Remove the WithDisabled option from the Jaeger exporter.
  To disable the exporter unregister it from the TracerProvider or use a no-operation TracerProvider. (#​1806)
• Removed the functions CollectorEndpointFromEnv and WithCollectorEndpointOptionFromEnv from the Jaeger exporter.
  These functions for retrieving specific environment variable values are redundant of other internal functions and
  are not intended for end user use. (#​1824)
• Removed the Jaeger exporter WithSDKOptions Option.
  This option was used to set SDK options for the exporter creation convenience functions.
  These functions are provided as a way to easily setup or install the exporter with what are deemed reasonable SDK settings for common use cases.
  If the SDK needs to be configured differently, the NewRawExporter function and direct setup of the SDK with the desired settings should be used. (#​1825)
• The WithBufferMaxCount and WithBatchMaxCount Options from the Jaeger exporter are removed.
  The exporter no longer batches exports, instead relying on the SDK's BatchSpanProcessor for this functionality. (#​1830)
• The Jaeger exporter Option type is removed.
  The type is no longer used by the exporter to configure anything.
  All of the previous configuration these options provided were duplicates of SDK configuration.
  They have all been removed in favor of using the SDK configuration and focuses the exporter configuration to be only about the endpoints it will send telemetry to. (#​1830)

---

Raw changes made between v0.19.0 and v0.20.0

02d8bdd (HEAD -> main, tag: v0.20.0, tag: trace/v0.20.0, tag: sdk/v0.20.0, tag: sdk/metric/v0.20.0, tag: sdk/export/metric/v0.20.0, tag: oteltest/v0.20.0, tag: metric/v0.20.0, tag: exporters/trace/zipkin/v0.20.0, tag: exporters/trace/jaeger/v0.20.0, tag: exporters/stdout/v0.20.0, tag: exporters/otlp/v0.20.0, tag: exporters/metric/prometheus/v0.20.0, tag: example/zipkin/v0.20.0, tag: example/prometheus/v0.20.0, tag: example/prom-collector/v0.20.0, tag: example/otel-collector/v0.20.0, tag: example/opencensus/v0.20.0, tag: example/namedtracer/v0.20.0, tag: example/jaeger/v0.20.0, tag: bridge/opentracing/v0.20.0, tag: bridge/opencensus/v0.20.0, upstream/main, origin/main) Release v0.20.0 (#​1837)
aa66fe7 OS and Process resource detectors (#​1788)
7374d67 Fix Links documents (#​1835)
856f5b8 Add feature request issue template (#​1831)
0fdc3d7 Remove bundler from Jaeger exporter (#​1830)
738ef11 Fix flaky global ErrorHandler delegation test (#​1829)
e43d9c0 Update Default Value for Jaeger Exporter Endpoint (#​1824)
0032bd6 Fix default merging of resource attributes from environment variable (#​1785)
96c5e4b Add SpanProcessor example for Span annotation on start (#​1733)
543c814 Remove the WithSDKOptions from the Jaeger exporter (#​1825)
66389ad Update function docs in sdk.go (#​1826)
70bc9eb Adds support for timeout on the otlp/gRPC exporter (#​1821)
081cc61 Update Jaeger exporter convenience functions (#​1822)
1b9f16d Remove the WithDisabled option from Jaeger exporter (#​1806)
6867faa Bump actions/cache from v2.1.4 to v2.1.5 (#​1818)
a2bf04d Build context pipeline in Jaeger upload process (#​1809)
2de86f2 Remove locking from Jaeger exporter shutdown/export (#​1807)
4f9fec2 Add ExportSpans benchmark to Jaeger exporter (#​1805)
d9566ab Fix OTLP testing flake: signal connection from mock collector (#​1816)
a2cecb6 add support for env var configuration to otlp/gRPC (#​1811)
d616df6 (fix-1527) Fix flaky OTLP exporter reconnect test (#​1814)
b09df84 Changes stdout to expose the *sdktrace.TracerProvider (#​1800)
0489060 Remove options field from Jaeger exporter (#​1808)
6db20e0 Remove the abandoned Process struct in Jaeger exporter (#​1804)
086abf3 docs: use test example to document prometheus.InstallNewPipeline (#​1796)
d0cea04 Bump google.golang.org/api from 0.43.0 to 0.44.0 in /exporters/trace/jaeger (#​1792)
99c477f Fixed typo for default service name in Jaeger Exporter (#​1797)
95fd8f5 Bump google.golang.org/grpc from 1.36.1 to 1.37.0 in /exporters/otlp (#​1791)
9b25164 Zipkin Exporter: Use default resouce's serviceName as default serivce name (#​1777) (#​1786)
4d141e4 Add k8s.node.name and k8s.node.uid to semconv (#​1789)
5c99a34 Fix golint issue caused by incorrect comment (#​1795)
c5d006c Update Jaeger environment variables (#​1752)
5843280 add NewExportPipeline and InstallNewPipeline for otlp (#​1373)
7d8e6bd Zipkin Exporter: Adjust span transformation to comply with the spec (#​1688)
2817c09 (ro-span) Merge sdk/export/trace into sdk/trace (#​1778)
c61e654 Refactor prometheus exporter tests to match file headers as well (#​1470)
23422c5 Remove process config for Jaeger exporter (#​1776)
0d49b59 Add test to check bsp ignores OnEnd and ForceFlush post Shutdown (#​1772)
e9aaa04 Record links/events attribute drops independently (#​1771)
5bbfc22 Make ExportSpans for Jaeger Exporter honor deadline (#​1773)
0786fe3 (default-res) Add Bug report issue templates (#​1775)
3c7face Add ExportTimeout option to batch span processor (#​1755)
c6b92d5 Make TraceFlags spec-compliant (#​1770)
ee687ca Bump github.com/itchyny/gojq from 0.12.2 to 0.12.3 in /internal/tools (#​1774)
52a2477 add support for configuring tls certs via env var to otlp/HTTP (#​1769)
35cfbc7 Update precedence of event name in Jaeger exporter (#​1768)
33699d2 Adds semantic conventions for exceptions (#​1492)
928e3c3 Modify ForceFlush to abort after timeout/cancellation (#​1757)
3947cab Fix testCollectorEndpoint typo and add tag assertions in jaeger_test (#​1753)
ecc635d add website docs (#​1747)
07a8d19 Fix Jaeger span status reporting and unify tag keys (#​1761)
4fa35c9 add partial support for env var config to otlp/HTTP (#​1758)
bf180d0 improve OTLP/gRPC connection errors (#​1737)
d575865 Fix span IsRecording when not sampling (#​1750)
20c93b0 Update SamplingParameters (#​1749)
97501a3 Update SpanSnapshot to use parent SpanContext (#​1748)
604b05c Store current Span instead of local and remote SpanContext in context.Context (#​1731)
c61f4b6 Set @​lizthegrey to emeritus status (#​1745)
b1342fe Bump github.com/golangci/golangci-lint in /internal/tools (#​1743)
54e1bd1 Bump google.golang.org/api from 0.41.0 to 0.43.0 in /exporters/trace/jaeger (#​1741)
4d25b6a Bump github.com/prometheus/client_golang from 1.9.0 to 1.10.0 in /exporters/metric/prometheus (#​1740)
0a47b66 Bump google.golang.org/grpc from 1.36.0 to 1.36.1 in /exporters/otlp (#​1739)
26f006b Reinstate @​paivagustavo as an Approver (#​1734)
382c7ce Remove hasRemoteParent field from SDK span (#​1728)
862a5a6 Remove setting error status while recording error with Span from oteltest package (#​1729)
6defcfd Remove links on NewRoot spans (#​1726)
a9b2f85 upgrade thrift to v0.14.1 in jaeger exporter (#​1712)
5a6a854 Bump google.golang.org/protobuf from 1.25.0 to 1.26.0 in /exporters/otlp (#​1724)
2348621 Migrate to using go.opentelemetry.io/proto/otlp (#​1713)
5d559b4 Remove makeSamplingDecision func (#​1711)
e24702d Update the TraceContext.Extract docs (#​1720)
9d4eb1f Update dates in CHANGELOG.md for 2021 releases (#​1723)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[forking-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
go.opentelemetry.io/otel/log	v0.19.0 -> v0.21.0