StackRadar

CVE-2024-36129

High

Advisory

Published 5 Jun 2024In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.012
68th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
23
of 17,781 indexed, latest versions
Container images
18
deployed by those charts
Fix available
2 of 2
affected packages

Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

Carried by container images the latest versions of 23 of 17,781 indexed charts deploy, on 18 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/collector/config/configgrpcgolangv0.80.0, v0.81.0, v0.83.0, v0.84.0+9 more0.102.117
go.opentelemetry.io/collector/config/confighttpgolangv0.81.0, v0.83.0, v0.84.0, v0.87.0+8 more0.102.015
OSV records
GHSA-c74f-6mfw-mm4v
Also known as
BIT-opentelemetry-collector-2024-36129, GO-2024-2900

Charts affected

23 by stars
ChartLatestAffected imagesRadar Score
aws-cloudwatch-metricsaws0.0.111 of 1See more

aws-cloudwatch-metrics aws 0.0.11

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
go.opentelemetry.io/collector/config/configgrpc@v0.84.0
0.102.1

Open the chart page →

1,556
jaeger-all-in-onejaeger-all-in-oneVerified publisher0.1.121 of 1See more

jaeger-all-in-one jaeger-all-in-one 0.1.12

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.55f6b5d09073f1
go.opentelemetry.io/collector/config/configgrpc@v0.95.0
go.opentelemetry.io/collector/config/confighttp@v0.95.0
0.102.1
0.102.0

Open the chart page →

1,216
coder-observabilitycoder-observabilityVerified publisher0.7.31 of 21See more

coder-observability coder-observability 0.7.3

1 of the 21 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
go.opentelemetry.io/collector/config/configgrpc@v0.87.0
go.opentelemetry.io/collector/config/confighttp@v0.87.0
0.102.1
0.102.0

Open the chart page →

24,700
elchi-stackelchi1.13.01 of 10See more

elchi-stack elchi 1.13.0

1 of the 10 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.89.0995f17004231
go.opentelemetry.io/collector/config/configgrpc@v0.89.0
go.opentelemetry.io/collector/config/confighttp@v0.89.0
0.102.1
0.102.0

Open the chart page →

15,383
joylive-injectorjoyliveOfficialVerified publisher1.3.51 of 2See more

joylive-injector joylive 1.3.5

1 of the 2 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
otel/opentelemetry-collector:0.100.09e36620d6c2c
go.opentelemetry.io/collector/config/configgrpc@v0.100.0
go.opentelemetry.io/collector/config/confighttp@v0.100.0
0.102.1
0.102.0

Open the chart page →

1,273
linkerd-jaegerlinkerd2-edgeVerified publisher30.14.11-edge1 of 4See more

linkerd-jaeger linkerd2-edge 30.14.11-edge

1 of the 4 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
go.opentelemetry.io/collector/config/configgrpc@v0.83.0
go.opentelemetry.io/collector/config/confighttp@v0.83.0
0.102.1
0.102.0

Open the chart page →

4,389
sp-otel-collectorsp-otel-collectorVerified publisher1.1.61 of 1See more

sp-otel-collector sp-otel-collector 1.1.6

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
go.opentelemetry.io/collector/config/configgrpc@v0.81.0
go.opentelemetry.io/collector/config/confighttp@v0.81.0
0.102.1
0.102.0

Open the chart page →

2,022
jaegerbook-k8sinfra-v23.4.01 of 5See more

jaeger book-k8sinfra-v2 3.4.0

1 of the 5 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0

Open the chart page →

19,229
pyroscopebook-k8sinfra-v21.10.01 of 3See more

pyroscope book-k8sinfra-v2 1.10.0

1 of the 3 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
grafana/alloy:v1.1.1c3dac4e26471
go.opentelemetry.io/collector/config/configgrpc@v0.99.0
go.opentelemetry.io/collector/config/confighttp@v0.99.0
0.102.1
0.102.0

Open the chart page →

3,244
tempobook-k8sinfra-v21.10.31 of 1See more

tempo book-k8sinfra-v2 1.10.3

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
grafana/tempo:2.5.0f0200a9bff6d
go.opentelemetry.io/collector/config/configgrpc@v0.97.0
go.opentelemetry.io/collector/config/confighttp@v0.97.0
0.102.1
0.102.0

Open the chart page →

1,859
catalyst-agentscatalyst-agents0.1.301 of 18See more

catalyst-agents catalyst-agents 0.1.30

1 of the 18 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
grafana/tempo:2.5.0f0200a9bff6d
go.opentelemetry.io/collector/config/configgrpc@v0.97.0
go.opentelemetry.io/collector/config/confighttp@v0.97.0
0.102.1
0.102.0

Open the chart page →

15,027
jaegergpg-dev3.3.31 of 5See more

jaeger gpg-dev 3.3.3

1 of the 5 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0

Open the chart page →

19,229
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:1.53.060e65bfffe1f
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0

Open the chart page →

49,025
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0

Open the chart page →

3,999
tracetestkubeshop0.3.391 of 2See more

tracetest kubeshop 0.3.39

1 of the 2 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
kubeshop/tracetest:v1.7.173d7e3a2db43
go.opentelemetry.io/collector/config/configgrpc@v0.80.0
0.102.1

Open the chart page →

1,554
lightsteplightstep-microsat2.0.211 of 1See more

lightstep lightstep-microsat 2.0.21

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
lightstep/microsatellite:2024-01-22_17-52-59Zc800e05e1eff
go.opentelemetry.io/collector/config/configgrpc@v0.94.1
0.102.1

Open the chart page →

1,116
apica-ascentlogiqai2.0.41 of 19See more

apica-ascent logiqai 2.0.4

1 of the 19 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
logiqai/flash:v3.10.265b996bc7bdc
go.opentelemetry.io/collector/config/confighttp@v0.90.1
0.102.0

Open the chart page →

23,613
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0

Open the chart page →

24,400
mw-kube-agentmiddleware-labsVerified publisher0.1.21 of 1See more

mw-kube-agent middleware-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
go.opentelemetry.io/collector/config/configgrpc@v0.84.0
go.opentelemetry.io/collector/config/confighttp@v0.84.0
0.102.1
0.102.0

Open the chart page →

1,594
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
go.opentelemetry.io/collector/config/configgrpc@v0.96.0
go.opentelemetry.io/collector/config/confighttp@v0.96.0
0.102.1
0.102.0

Open the chart page →

7,309
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
go.opentelemetry.io/collector/config/configgrpc@v0.96.0
go.opentelemetry.io/collector/config/confighttp@v0.96.0
0.102.1
0.102.0

Open the chart page →

1,721
jaegerwikimedia3.1.21 of 4See more

jaeger wikimedia 3.1.2

1 of the 4 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
jaegertracing/jaeger-collector:1.53.07f1269222903
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0

Open the chart page →

9,248
opentelemetry-collectorwikimedia0.62.71 of 1See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2024-36129.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
go.opentelemetry.io/collector/config/configgrpc@v0.81.0
go.opentelemetry.io/collector/config/confighttp@v0.81.0
0.102.1
0.102.0

Open the chart page →

2,022

Container images carrying it

18 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
jaegertracing/jaeger-collector:1.53.07f1269222903
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0
4
grafana/tempo:2.5.0f0200a9bff6d
go.opentelemetry.io/collector/config/configgrpc@v0.97.0
go.opentelemetry.io/collector/config/confighttp@v0.97.0
0.102.1
0.102.0
2
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
go.opentelemetry.io/collector/config/configgrpc@v0.96.0
go.opentelemetry.io/collector/config/confighttp@v0.96.0
0.102.1
0.102.0
2
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
go.opentelemetry.io/collector/config/configgrpc@v0.84.0
0.102.1
1
datadog/agent:6aad9994de6a7
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0
1
grafana/agent:v0.40.3f6cbec9409be
go.opentelemetry.io/collector/config/configgrpc@v0.87.0
go.opentelemetry.io/collector/config/confighttp@v0.87.0
0.102.1
0.102.0
1
grafana/alloy:v1.1.1c3dac4e26471
go.opentelemetry.io/collector/config/configgrpc@v0.99.0
go.opentelemetry.io/collector/config/confighttp@v0.99.0
0.102.1
0.102.0
1
jaegertracing/all-in-one:1.53.060e65bfffe1f
go.opentelemetry.io/collector/config/configgrpc@v0.91.0
go.opentelemetry.io/collector/config/confighttp@v0.91.0
0.102.1
0.102.0
1
jaegertracing/all-in-one:1.55f6b5d09073f1
go.opentelemetry.io/collector/config/configgrpc@v0.95.0
go.opentelemetry.io/collector/config/confighttp@v0.95.0
0.102.1
0.102.0
1
kubeshop/tracetest:v1.7.173d7e3a2db43
go.opentelemetry.io/collector/config/configgrpc@v0.80.0
0.102.1
1
lightstep/microsatellite:2024-01-22_17-52-59Zc800e05e1eff
go.opentelemetry.io/collector/config/configgrpc@v0.94.1
0.102.1
1
logiqai/flash:v3.10.265b996bc7bdc
go.opentelemetry.io/collector/config/confighttp@v0.90.1
0.102.0
1
otel/opentelemetry-collector:0.100.09e36620d6c2c
go.opentelemetry.io/collector/config/configgrpc@v0.100.0
go.opentelemetry.io/collector/config/confighttp@v0.100.0
0.102.1
0.102.0
1
otel/opentelemetry-collector-contrib:0.83.071fcef33ae71
go.opentelemetry.io/collector/config/configgrpc@v0.83.0
go.opentelemetry.io/collector/config/confighttp@v0.83.0
0.102.1
0.102.0
1
otel/opentelemetry-collector-contrib:0.89.0995f17004231
go.opentelemetry.io/collector/config/configgrpc@v0.89.0
go.opentelemetry.io/collector/config/confighttp@v0.89.0
0.102.1
0.102.0
1
otel/opentelemetry-collector-contrib:0.81.0c6671841470b
go.opentelemetry.io/collector/config/configgrpc@v0.81.0
go.opentelemetry.io/collector/config/confighttp@v0.81.0
0.102.1
0.102.0
1
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
go.opentelemetry.io/collector/config/configgrpc@v0.84.0
go.opentelemetry.io/collector/config/confighttp@v0.84.0
0.102.1
0.102.0
1
quay.io/geored/spmm-collector-contrib:1.0.063baf86a49ac
go.opentelemetry.io/collector/config/configgrpc@v0.81.0
go.opentelemetry.io/collector/config/confighttp@v0.81.0
0.102.1
0.102.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.