CVE-2023-45142
HighAdvisory
Published 16 Oct 2023In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.014
- 70th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 152
- of 17,781 indexed, latest versions
- Container images
- 156
- deployed by those charts
- Fix available
- 5 of 5
- affected packages
OpenTelemetry-Go Contrib vulnerable to denial of service in otelhttp due to unbound cardinality metrics
Carried by container images the latest versions of 152 of 17,781 indexed charts deploy, on 156 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v0.16.0, v0.20.0, v0.22.0, v0.23.0+15 more | 0.44.0 | 149 |
| go.opentelemetry.io/ | v0.16.0, v0.28.0, v0.29.0, v0.36.4+2 more | 0.44.0 | 23 |
| go.opentelemetry.io/ | v0.36.3, v0.36.4, v0.40.0, v0.42.0 | 0.44.0 | 8 |
| go.opentelemetry.io/ | v0.20.0, v0.35.0, v0.36.4 | 0.44.0 | 5 |
| go.opentelemetry.io/ | v0.22.0, v0.28.0 | 0.44.0 | 3 |
- OSV records
- GHSA-rcjv-mgp8-qvmr
- Also known as
- GO-2023-2113
Charts affected
152 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| opentelemetry-collectorwikimedia | 0.62.7 | 1 of 1See more | 2,022 |
| matrixdb-operatorymatrixOfficialVerified publisher | 0.13.0 | 1 of 2See more | 1,958 |
Container images carrying it
156 by charts deploying them
A fixed version is listed for 5 of the 5 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| wurstmeister/ | 2d4bbf9cc83d | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 7 |
| grafana/ | 1ee60f980950 | go.opentelemetry.io/ | 0.44.0 | 4 |
| ghcr.io/ | ab2e1fa19dd4 | go.opentelemetry.io/ | 0.44.0 | 4 |
| quay.io/ | 6b83f55bd99e | go.opentelemetry.io/ | 0.44.0 | 4 |
| quay.io/ | 48ea4a77dfa7 | go.opentelemetry.io/ | 0.44.0 | 4 |
| library/ | af96c680a7e1 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 3 |
| quay.io/ | 75fb847ac045 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 3 |
| quay.io/ | a7dff785d821 | go.opentelemetry.io/ | 0.44.0 | 3 |
| quay.io/ | 1a3e9a878e50 | go.opentelemetry.io/ | 0.44.0 | 3 |
| quay.io/ | f5c29683a301 | go.opentelemetry.io/ | 0.44.0 | 3 |
| grafana/ | f9ef133793af | go.opentelemetry.io/ | 0.44.0 | 2 |
| k0sproject/ | f04635825d51 | go.opentelemetry.io/ | 0.44.0 | 2 |
| oryd/ | d06fc5845f63 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 2 |
| oryd/ | e8cb9b79a89c | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 2 |
| prom/ | 8176adea328e | go.opentelemetry.io/ | 0.44.0 | 2 |
| rancher/ | 9380f5dbae9a | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 2 |
| streamnative/ | 0e6d7aa3ef32 | go.opentelemetry.io/ | 0.44.0 | 2 |
| zhenghaoz/ | 033046b432ec | go.opentelemetry.io/ | 0.44.0 | 2 |
| zhenghaoz/ | 39c565685b01 | go.opentelemetry.io/ | 0.44.0 | 2 |
| quay.io/ | 58d91a5faaf8 | go.opentelemetry.io/ | 0.44.0 | 2 |
| quay.io/ | 738c854322f5 | go.opentelemetry.io/ | 0.44.0 | 2 |
| quay.io/ | d429b6d696e0 | go.opentelemetry.io/ | 0.44.0 | 2 |
| quay.io/ | 6730d96fc382 | go.opentelemetry.io/ | 0.44.0 | 2 |
| quay.io/ | c5dd35038287 | go.opentelemetry.io/ | 0.44.0 | 2 |
| quay.io/ | df0cd5887887 | go.opentelemetry.io/ | 0.44.0 | 2 |
| registry.k8s.io/ | 99e1ed9fbc8a | go.opentelemetry.io/ | 0.44.0 | 2 |
| registry.k8s.io/ | 40adecbe3a40 | go.opentelemetry.io/ | 0.44.0 | 2 |
| amazon/ | d8ab0eef5074 | go.opentelemetry.io/ | 0.44.0 | 1 |
| amazon/ | 73b79b02f03a | go.opentelemetry.io/ | 0.44.0 | 1 |
| deepflowce/ | 6b51a0206b04 | go.opentelemetry.io/ | 0.44.0 | 1 |
| deepflowce/ | 34fcc526dd59 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 1 |
| elastic/ | c7a1c63257d0 | go.opentelemetry.io/ | 0.44.0 | 1 |
| gboxproxy/ | 3a9f4a711d5c | go.opentelemetry.io/ | 0.44.0 | 1 |
| gocrane/ | 9ba6d11b2079 | go.opentelemetry.io/ | 0.44.0 | 1 |
| goharbor/ | 6412d679fdc3 | go.opentelemetry.io/ | 0.44.0 | 1 |
| goharbor/ | 86bf3031f4a7 | go.opentelemetry.io/ | 0.44.0 | 1 |
| goharbor/ | 39435daedd0c | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 1 |
| goharbor/ | 8d5339ff2d74 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 1 |
| goharbor/ | 7f82ed1e2635 | go.opentelemetry.io/ | 0.44.0 | 1 |
| goharbor/ | cce272836449 | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | 825c09373d27 | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | 0679e877ba20 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 1 |
| grafana/ | 1b9ca4bbc4a2 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.44.0 0.44.0 | 1 |
| grafana/ | 39c849cebccc | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | 6074e01dbe03 | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | b1da1d23037e | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | 4249db29b992 | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | ab2a2569307b | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | 330f990cdad9 | go.opentelemetry.io/ | 0.44.0 | 1 |
| grafana/ | 072527b12cdf | go.opentelemetry.io/ | 0.44.0 | 1 |