StackRadar

CVE-2023-45142

High

Advisory

Published 16 Oct 2023In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.014
70th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
152
of 17,781 indexed, latest versions
Container images
156
deployed by those charts
Fix available
5 of 5
affected packages

OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics

Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 156 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttpgolangv0.16.0, v0.20.0, v0.22.0, v0.23.0+15 more0.44.0149
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptracegolangv0.16.0, v0.28.0, v0.29.0, v0.36.4+2 more0.44.023
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgingolangv0.36.3, v0.36.4, v0.40.0, v0.42.00.44.08
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestfulgolangv0.20.0, v0.35.0, v0.36.40.44.05
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmuxgolangv0.22.0, v0.28.00.44.03
OSV records
GHSA-rcjv-mgp8-qvmr
Also known as
GO-2023-2113

Charts affected

152 by stars
ChartLatestAffected imagesRadar Score
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2023-45142.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0

Open the chart page →

2,022
matrixdb-operatorymatrixOfficialVerified publisher0.13.01 of 2See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2023-45142.

Container imageDigestPackageFixed in
matrixdb/kubebuilder_kube-rbac-proxy:v0.12.0ed3c7e6291e8
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0

Open the chart page →

1,958

Container images carrying it

156 by charts deploying them

A fixed version is listed for 5 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
wurstmeister/kafka:latest2d4bbf9cc83d
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.29.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
0.44.0
7
grafana/loki:2.6.11ee60f980950
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
4
ghcr.io/loft-sh/vcluster-pro:0.0.0-ci-run.10ab2e1fa19dd4
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.40.0
0.44.0
4
quay.io/jetstack/cert-manager-controller:v1.13.16b83f55bd99e
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0
0.44.0
4
quay.io/jetstack/cert-manager-webhook:v1.13.148ea4a77dfa7
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0
0.44.0
4
library/docker:20.10-dind:20-dindaf96c680a7e1
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.29.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
0.44.0
3
quay.io/devtron/clair:4.3.675fb847ac045
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.16.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.16.0
0.44.0
0.44.0
3
quay.io/openshift/origin-oauth-proxy:4.14a7dff785d821
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.1
0.44.0
3
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.37.0
0.44.0
3
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.40.0
0.44.0
3
grafana/loki:2.5.0f9ef133793af
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
2
k0sproject/k0s:v1.26.0-k0s.0f04635825d51
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
2
oryd/kratos:v1.0.0d06fc5845f63
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.36.4
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.36.4
0.44.0
0.44.0
2
oryd/oathkeeper:v0.40.6e8cb9b79a89c
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.36.4
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.36.4
0.44.0
0.44.0
2
prom/prometheus:v2.37.98176adea328e
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.32.0
0.44.0
2
rancher/k3s:v1.26.0-k3s19380f5dbae9a
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful@v0.35.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
0.44.0
2
streamnative/apache-pulsar-grafana-dashboard-k8s:0.1.20e6d7aa3ef32
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.37.0
0.44.0
2
zhenghaoz/gorse-master:0.4.12033046b432ec
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful@v0.36.4
0.44.0
2
zhenghaoz/gorse-server:0.4.1239c565685b01
go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful@v0.36.4
0.44.0
2
quay.io/brancz/kube-rbac-proxy:v0.14.158d91a5faaf8
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
2
quay.io/brancz/kube-rbac-proxy:v0.13.1738c854322f5
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
2
quay.io/jetstack/cert-manager-controller:v1.11.0d429b6d696e0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
2
quay.io/jetstack/cert-manager-webhook:v1.11.06730d96fc382
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
2
quay.io/prometheus/prometheus:v2.47.0c5dd35038287
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
2
quay.io/prometheus/prometheus:v2.36.2df0cd5887887
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.32.0
0.44.0
2
registry.k8s.io/kube-apiserver:v1.26.199e1ed9fbc8a
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
2
registry.k8s.io/kube-controller-manager:v1.26.140adecbe3a40
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.35.0
0.44.0
2
amazon/aws-otel-collector:v0.27.0d8ab0eef5074
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.39.0
0.44.0
1
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.43.0
0.44.0
1
deepflowce/deepflowio-init-grafana:v6.2.6.56b51a0206b04
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.37.0
0.44.0
1
deepflowce/deepflow-server:v6.2.6.534fcc526dd59
go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin@v0.36.3
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.32.0
0.44.0
0.44.0
1
elastic/apm-server:7.17.6c7a1c63257d0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.22.0
0.44.0
1
gboxproxy/gbox:v1.0.63a9f4a711d5c
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
1
gocrane/crane-scheduler:0.0.239ba6d11b2079
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.20.0
0.44.0
1
goharbor/harbor-core:v2.9.06412d679fdc3
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.22.0
0.44.0
1
goharbor/harbor-core:v2.5.386bf3031f4a7
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.22.0
0.44.0
1
goharbor/harbor-jobservice:v2.9.039435daedd0c
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux@v0.22.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.22.0
0.44.0
0.44.0
1
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux@v0.22.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.22.0
0.44.0
0.44.0
1
goharbor/harbor-registryctl:v2.5.37f82ed1e2635
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.22.0
0.44.0
1
goharbor/harbor-registryctl:v2.9.0cce272836449
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.22.0
0.44.0
1
grafana/agent:v0.20.0825c09373d27
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.23.0
0.44.0
1
grafana/grafana:10.1.50679e877ba20
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.37.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
0.44.0
1
grafana/grafana:10.1.11b9ca4bbc4a2
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.37.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.42.0
0.44.0
0.44.0
1
grafana/grafana:9.5.239c849cebccc
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace@v0.37.0
0.44.0
1
grafana/loki:2.9.26074e01dbe03
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.40.0
0.44.0
1
grafana/loki:2.8.2b1da1d23037e
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.37.0
0.44.0
1
grafana/loki-canary:2.9.24249db29b992
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.40.0
0.44.0
1
grafana/loki-canary:2.6.1ab2a2569307b
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
1
grafana/phlare:0.5.1330f990cdad9
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.37.0
0.44.0
1
grafana/promtail:2.6.1072527b12cdf
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.29.0
0.44.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.