StackRadar

CVE-2023-45142

High

Advisory

Published 16 Oct 2023In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
70th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
152
of 17,781 indexed, latest versions
Container images
156
deployed by those charts
Fix available
5 of 5
affected packages

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 156 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpgolangv0.16.0, v0.20.0, v0.22.0, v0.23.0+15 more0.44.0149
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptracegolangv0.16.0, v0.28.0, v0.29.0, v0.36.4+2 more0.44.023
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgingolangv0.36.3, v0.36.4, v0.40.0, v0.42.00.44.08
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestfulgolangv0.20.0, v0.35.0, v0.36.40.44.05
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmuxgolangv0.22.0, v0.28.00.44.03
OSV records
GHSA-rcjv-mgp8-qvmr
Also known as
GO-2023-2113

Charts affected

152 by stars
ChartLatestAffected imagesRadar Score
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2023-45142.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0

Open the chart page →

2,022
matrixdb-operatorymatrixOfficialVerified publisher0.13.01 of 2See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2023-45142.

Container imageDigestPackageFixed in
matrixdb/kubebuilder_kube-rbac-proxy:v0.12.0ed3c7e6291e8
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0

Open the chart page →

1,958

Container images carrying it

156 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/keptn/scheduler:v0.8.20f7d277bb2b2
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/kubedb/kubedb-autoscaler:v0.25.0df6b11907d33
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/kubedb/kubedb-dashboard:v0.16.07bfe1c07bd9b
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/kubedb/kubedb-ops-manager:v0.27.1ec36422b09af
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/kubedb/kubedb-provisioner:v0.40.242574f512837
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/kubedb/kubedb-schema-manager:v0.16.09518de37eed5
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/kubedb/kubedb-webhook-server:v0.16.2e24894e32cbc
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
1
ghcr.io/loft-sh/agent:3.2.45c109914ff73
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.38.0
0.44.0
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.29.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
0.44.0
1
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
1
ghcr.io/loft-sh/vcluster:0.16.484f70425f4dd
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.29.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
0.44.0
1
ghcr.io/middleware-labs/agent-kube-go:dev17369c4cd390
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.37.0
0.44.0
1
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
1
ghcr.io/mohammadv184/cert-manager-webhook-arvancloud:latest179bee5ef8b2
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0
0.44.0
1
ghcr.io/schmitzis/cert-manager-webhook-bunny:latest125e31c8e85a
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
1
ghcr.io/stashed/stash-enterprise:v0.32.0e9bde36e34b7
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
ghcr.io/stefanprodan/podinfo:6.1.3f25ebb9c6788
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux@v0.28.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.28.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.28.0
0.44.0
0.44.0
0.44.0
1
ghcr.io/synapsecns/sanguine/agents:6e3887fc2a05aff0d159453cedbfbe5024b910bf81a9ebc899a4
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin@v0.40.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.40.0
0.44.0
0.44.0
1
ghcr.io/synapsecns/sanguine/cctp-relayer:b5a1dd5288f1a18eb05994e130d626fed45a56fc2f1408c94168
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin@v0.40.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.40.0
0.44.0
0.44.0
1
ghcr.io/synapsecns/sanguine/promexporter:4a9aad096c2bd1160e56e5472ddac77fa0cde2e9416c1c5aeb86
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin@v0.40.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
0.44.0
1
ghcr.io/synapsecns/sanguine/scribe:6e3887fc2a05aff0d159453cedbfbe5024b910bf5e0a3dfa9f96
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin@v0.40.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.40.0
0.44.0
0.44.0
1
ghcr.io/synapsecns/sanguine/sinner:latest3e98a98f6074
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin@v0.42.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
0.44.0
1
ghcr.io/v6d-io/v6d/kube-rbac-proxy:v0.13.0a2523c532c0c
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
public.ecr.aws/docker/library/caddy:2.6.387cbd356af2e
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0
0.44.0
1
public.ecr.aws/groundcovercom/loki-proxy:0.1.1783d550ad813
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
1
public.ecr.aws/supportpal/helpdesk-monolithic:4.0.4573779e57fae
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
1
quay.io/brancz/kube-rbac-proxy:v0.15.02c7b120590cb
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/cloudnativetoolkit/cloud-pak-deployer:latest13aaae779248
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.37.0
0.44.0
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
1
quay.io/jetstack/cert-manager-controller:v1.10.11143471c90db
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/jetstack/cert-manager-controller:v1.12.04a9d0264055b
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0
0.44.0
1
quay.io/jetstack/cert-manager-controller:v1.8.2a20c44021a5d
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/jetstack/cert-manager-controller:v1.8.0e1642bf8e933
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/jetstack/cert-manager-webhook:v1.10.164121721c665
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/jetstack/cert-manager-webhook:v1.8.2ada7edd90bec
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/jetstack/cert-manager-webhook:v1.12.0ec4306b243d9
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0
0.44.0
1
quay.io/jetstack/cert-manager-webhook:v1.8.0fd798a5a773e
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/kubernetes-multicluster/kubefed:v0.10.0c4635c95730e
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/open-cluster-management/multicluster-mesh-addon:latest3e010e1188f1
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
quay.io/operator-framework/olmf9ea8cef95ac
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
1
quay.io/opsmxpublic/forwarder-controller:v3.5.7f0c5bebaec96
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.34.0
0.44.0
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.36.0
0.44.0
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.32.0
0.44.0
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker:mainf91b602ca572
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere:v1.28.0026f63d9ed42
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.41.1
0.44.0
1
registry.k8s.io/kube-apiserver:v1.25.0f6902791fb9a
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.