opentelemetry-demo 0.42.2 Helm chart

Name: opentelemetry-demo Helm chart 0.42.2: images and vulnerabilities
Creator: StackRadar
License: https://creativecommons.org/licenses/by/4.0/

opentelemetry-helm

Scored 3 Oct 2026

opentelemetry demo helm chart

Version 0.42.2 todayapp version 3.1.0 1Artifact Hub

opentelemetry-demo 0.42.2 deploys 34 container images: otel/opentelemetry-collector-contrib, quay.io/kiwigrid/k8s-sidecar, grafana/grafana, jaegertracing/jaeger and 7 more. Across the 33 measured, 2,335 findings — 3 critical, 2 high. The highest contribution is ALPINE-CVE-2025-15467 in openssl 3.5.4-r0, fixed in 3.5.5-r0.

Radar Score

24,359323461,981

2,335 findings over 33 of 34 images measured

Radar Score is the sum of every finding’s contribution; the colour is the worst finding’s band.

Container images

34 images

Image	Tag	Vulnerabilities	Radar Score
otel/opentelemetry-collector-contrib	0.160.0	0069	178
quay.io/kiwigrid/k8s-sidecar×3	2.11.2	00011	97
grafana/grafana	13.2.2-distroless	00856	687
jaegertracing/jaeger	2.20.0	00926	426
quay.io/prometheus/prometheus	v3.14.0	00313	137
library/busybox×6	latest	0000	0
ghcr.io/open-telemetry/demo	3.1.0-accounting	00652	522
ghcr.io/open-telemetry/demo	3.1.0-ad	1029195	2,267
ghcr.io/open-telemetry/demo	3.1.0-agent	0010179	1,712
library/postgres	18.4	0026183	2,190
ghcr.io/open-telemetry/demo	3.1.0-cart	0000	0
ghcr.io/open-telemetry/demo	3.1.0-chatbot	0010165	1,597
ghcr.io/open-telemetry/demo	3.1.0-checkout	0001	4
ghcr.io/open-telemetry/demo	3.1.0-currency	0000	0
ghcr.io/open-telemetry/demo	3.1.0-email	001223	452
library/busybox	latest	0000	0
ghcr.io/open-feature/flagd	v0.16.0	001143	599
ghcr.io/open-telemetry/demo	3.1.0-flagd-ui	008100	1,037
ghcr.io/open-telemetry/demo	3.1.0-fraud-detection	0024118	1,477
ghcr.io/open-telemetry/demo	3.1.0-frontend	00737	463
ghcr.io/open-telemetry/demo	3.1.0-frontend-proxy	1235100	1,723
ghcr.io/open-telemetry/demo	3.1.0-image-provider	102565	1,093
ghcr.io/open-telemetry/demo	3.1.0-kafka	001251	712
ghcr.io/open-telemetry/demo	3.1.0-load-generator	0040228	2,732
ghcr.io/open-telemetry/demo	3.1.0-mcp	0010179	1,712
ghcr.io/open-telemetry/demo	3.1.0-opamp-server	0069	197
ghcr.io/open-telemetry/demo	3.1.0-payment	001946	820
ghcr.io/open-telemetry/demo	3.1.0-product-catalog	0000	0
ghcr.io/open-telemetry/demo	3.1.0-quote	0037	135
ghcr.io/open-telemetry/demo	3.1.0-recommendation	0004	38
ghcr.io/open-telemetry/demo	3.1.0-shipping	00731	408
ghcr.io/open-telemetry/demo	3.1.0-telemetry-docs	001542	757
ghcr.io/valkey-io/valkey	9.0.4-alpine3.23	0058	187
opensearchproject/opensearch×2	3.8.0	—	not yet scanned

Rendered with the chart’s default values for linux/amd64. Optional subcharts, images set by operator flags and images inside CRD payloads are not seen and are counted as unmeasured.

Vulnerabilities

837 distinct across the version’s images

Severity	Advisory	Package	Fixed in
Low	GHSA-wjgm-6hv5-3cvf	jackson-databind@2.21.2	2.21.6
Low	GO-2025-4175	stdlib@go1.24.6	1.24.11
Low	GHSA-qc2q-p7wx-3px3	google.golang.org/grpc@v1.81.1	1.83.1
Low	GHSA-qpw4-5x99-6vjp	golang.org/x/crypto@v0.49.0	0.52.0
Low	GHSA-9m57-25v3-79x9	golang.org/x/crypto@v0.49.0	0.52.0
Low	GO-2026-4864	stdlib@go1.25.7	1.25.9
Low	ALPINE-CVE-2026-6429	curl@8.19.0-r0	8.20.0-r0
Low	GO-2026-4603	stdlib@go1.25.7	1.25.8
Low	GO-2026-4865	stdlib@go1.25.7	1.25.9
Low	GO-2026-4982	stdlib@go1.25.7	1.25.10
Low	GO-2026-5025	golang.org/x/net@v0.51.0	0.55.0
Low	DEBIAN-CVE-2026-86143	libxml2@2.9.14+dfsg-1.3~deb12u6	no fix listed
Low	GHSA-r6x4-923q-g947	pyjwt@2.13.0	2.14.0
Low	DEBIAN-CVE-2026-86140	libxml2@2.9.14+dfsg-1.3~deb12u6	no fix listed
Low	DEBIAN-CVE-2026-86142	libxml2@2.9.14+dfsg-1.3~deb12u6	no fix listed
Low	ALPINE-CVE-2026-78410	util-linux@2.41.4-r0	2.41.6-r0
Low	DEBIAN-CVE-2026-78410	util-linux@2.41.5-0+deb13u1	no fix listed
Low	ALPINE-CVE-2026-34181	openssl@3.5.6-r0	3.5.7-r0
Low	ALPINE-CVE-2026-4873	curl@8.19.0-r0	8.20.0-r0
Low	ALPINE-CVE-2026-89160	pcre2@10.47-r0	10.48-r0
Low	DEBIAN-CVE-2026-89160	pcre2@10.46-1~deb13u1	10.46-1~deb13u2
Low	GHSA-w6j9-cwv2-h6wq	pyjwt@2.13.0	2.14.0
Low	UBUNTU-CVE-2025-68973	gnupg2@2.4.4-2ubuntu17.3	2.4.4-2ubuntu17.4
Low	UBUNTU-CVE-2026-102633	expat@2.6.1-2ubuntu0.3	no fix listed
Low	DEBIAN-CVE-2026-15588	glib2.0@2.74.6-2+deb12u8	no fix listed
Low	GHSA-vffh-x6r8-xx99	github.com/prometheus/prometheus@v0.0.0-20260817133844-d7598b714141+dirty	0.311.2-0.20260410083055-07c6232d159b
Low	DEBIAN-CVE-2022-0563	util-linux@2.41.5-0+deb13u1	no fix listed
Low	GHSA-9j54-fg26-wv3r	pyjwt@2.13.0	2.14.0
Low	GHSA-p4g4-x82p-q773	pyjwt@2.13.0	2.14.0
Low	GHSA-w2cx-738m-mc7w	pyjwt@2.13.0	2.14.0
Low	GO-2026-6091	stdlib@go1.26.4	1.25.13
Low	DEBIAN-CVE-2026-11979	libxml2@2.9.14+dfsg-1.3~deb12u6	no fix listed
Low	GO-2025-4008	stdlib@go1.24.6	1.24.8
Low	GO-2025-4010	stdlib@go1.24.6	1.24.8
Low	GHSA-ffqx-q65f-36jf	github.com/grafana/tempo@v1.5.1-0.20250529124718-87c2dc380cec	2.10.3
Low	DEBIAN-CVE-2026-3441	binutils@2.44-3	no fix listed
Low	DEBIAN-CVE-2026-3442	binutils@2.44-3	no fix listed
Low	GHSA-hrxh-6v49-42gf	google.golang.org/grpc@v1.81.1	1.82.1
Low	DEBIAN-CVE-2026-89158	pcre2@10.46-1~deb13u1	10.46-1~deb13u2
Low	DEBIAN-CVE-2026-93542	libxi@2:1.8-1+b1	no fix listed
Low	GHSA-8c42-7qj2-3j46	netty-codec-http@4.2.16.Final	4.2.17.Final
Low	DSA-6189-1	libpng1.6@1.6.39-2+deb12u3	1.6.39-2+deb12u4
Low	DEBIAN-CVE-2026-93541	libxi@2:1.8-1+b1	no fix listed
Low	DEBIAN-CVE-2026-93544	libxi@2:1.8-1+b1	no fix listed
Low	GHSA-9fxm-vc8v-hj55	jackson-databind@2.21.2	2.21.4
Low	DEBIAN-CVE-2026-5704	tar@1.35+dfsg-3.1	no fix listed
Low	DEBIAN-CVE-2023-45913	mesa@22.3.6-1+deb12u2	no fix listed
Low	GHSA-5jmj-h7xm-6q6v	jackson-databind@2.21.2	2.21.5
Low	DEBIAN-CVE-2026-22693	harfbuzz@6.0.0+dfsg-3	no fix listed
Low	DEBIAN-CVE-2026-27447	cups@2.4.2-3+deb12u9	no fix listed

Indexed versions

Version	Published	App version	Vulnerabilities	Radar Score
0.42.2latest	today	3.1.0	323461,981	24,359
0.42.1	7 days ago	3.1.0	323461,981	24,359
0.42.0	14 days ago	3.1.0	323461,981	24,359
0.41.2	17 days ago	3.0.0	053821,922	24,544
0.41.1	21 days ago	3.0.0	053821,922	24,544
0.41.0	2 months ago	3.0.0	053821,922	24,544

The latest version and the previous major, as selected nightly from the repository’s index.

README badge

[![Radar Score](https://charts.stackradar.io/badge/opentelemetry-helm/opentelemetry-demo.svg)](https://charts.stackradar.io/charts/opentelemetry-helm/opentelemetry-demo)

Markdown. The badge shows the latest version’s band and Radar Score, refreshed daily.