Microsoft’s Security Update Guide entry for CVE-2026-39882, published after the OpenTelemetry-Go advisory in April 2026, flags a denial-of-service flaw in the Go OTLP HTTP exporters that can let a malicious or intercepted collector response exhaust memory in instrumented applications. The bug is...