🛡️ CVE-2026-39882 on Go (Root.io) — otlptracehttp

Distribution advisory

This page covers CVE-2026-39882 as tracked by Go (Root.io), for the package otlptracehttp. The fix is available in version v1.35.0-aikido.1; earlier versions remain affected.

How this vulnerability can be exploited

This issue can be reached from an adjacent network, attack complexity is high, an attacker needs no privileges on the target. No user interaction is required. The scope is unchanged, so the impact stays within the vulnerable component. Rated impact: confidentiality none, integrity none, availability high.

Weakness class

ROOT-APP-GOBINARY-CVE-2026-39882 is classified as CWE-789: Memory Allocation with Excessive Size Value. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected software

ROOT-APP-GOBINARY-CVE-2026-39882 is recorded against 2 packages.

• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (fixed in v1.35.0-aikido.1)
• rootio-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (fixed in v1.35.0-root.io.1)

Timeline and source

Published on 22 July 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

CVE-2026-39882 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Details

Affected Packages

References