CVE-2026-114603
MediumAdvisory
Published 22 Oct 2026In the index since 23 Oct 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- —
- probability of exploitation
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 130
- of 18,232 indexed, latest versions
- Container images
- 149
- deployed by those charts
- Fix available
- 1 of 1
- affected package
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
Carried by container images the latest versions of 130 of 18,232 indexed charts deploy, on 149 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| opentelemetry-apipypi | 1.11.1, 1.12.0rc2, 1.18.0, 1.20.0+24 more | 1.45.1 | 149 |
- OSV records
- GHSA-xcq7-p3pf-p88h
Charts affected
130 by stars
Container images carrying it
149 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| dpage/ | c332c5f6dfba | opentelemetry-api | 1.45.1 | 5 |
| opea/ | 0c25aab3f106 | opentelemetry-api | 1.45.1 | 4 |
| langflowai/ | a0396e089eb9 | opentelemetry-api | 1.45.1 | 3 |
| localstack/ | aa5632e041ca | opentelemetry-api | 1.45.1 | 2 |
| opea/ | 5c9639de61c1 | opentelemetry-api | 1.45.1 | 2 |
| opea/ | e48613afb191 | opentelemetry-api | 1.45.1 | 2 |
| opea/ | eb746b263705 | opentelemetry-api | 1.45.1 | 2 |
| ghcr.io/ | 7294b90f868c | opentelemetry-api | 1.45.1 | 2 |
| ghcr.io/ | 896fc7b18b1b | opentelemetry-api | 1.45.1 | 2 |
| ghcr.io/ | 78eb28b8776d | opentelemetry-api | 1.45.1 | 2 |
| agentarea/ | de166c910ef9 | opentelemetry-api | 1.45.1 | 1 |
| agentarea/ | 8b80f30570ff | opentelemetry-api | 1.45.1 | 1 |
| agentarea/ | adb761a4d103 | opentelemetry-api | 1.45.1 | 1 |
| airbyte/ | deec511b51c3 | opentelemetry-api | 1.45.1 | 1 |
| akeyless/ | 0f582fc294a0 | opentelemetry-api | 1.45.1 | 1 |
| apache/ | 64e58748b6b9 | opentelemetry-api | 1.45.1 | 1 |
| apache/ | ce90bdc3d2af | opentelemetry-api | 1.45.1 | 1 |
| apache/ | e5560ad0b86e | opentelemetry-api | 1.45.1 | 1 |
| apecloud/ | 8ac9947a2c84 | opentelemetry-api | 1.45.1 | 1 |
| baserow/ | 497347d0ba74 | opentelemetry-api | 1.45.1 | 1 |
| baserow/ | e0b3c8130b91 | opentelemetry-api | 1.45.1 | 1 |
| baserow/ | df0c42eb67e8 | opentelemetry-api | 1.45.1 | 1 |
| behnambm/ | bd3ad88afff9 | opentelemetry-api | 1.45.1 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | opentelemetry-api | 1.45.1 | 1 |
| burakince/ | ab4b566644b9 | opentelemetry-api | 1.45.1 | 1 |
| checkmk/ | c11b422210c4 | opentelemetry-api | 1.45.1 | 1 |
| codecov/ | 0475cb1c3136 | opentelemetry-api | 1.45.1 | 1 |
| codecov/ | 837f546b479b | opentelemetry-api | 1.45.1 | 1 |
| dagster/ | c9320c34f7ed | opentelemetry-api | 1.45.1 | 1 |
| decisionrules/ | b18f5190807b | opentelemetry-api | 1.45.1 | 1 |
| deepflowce/ | a1888d35e787 | opentelemetry-api | 1.45.1 | 1 |
| deepflowce/ | aa9468ad4d96 | opentelemetry-api | 1.45.1 | 1 |
| devopstales/ | 8bb837da5aec | opentelemetry-api | 1.45.1 | 1 |
| fabriziosalmi/ | 033315ddb6ef | opentelemetry-api | 1.45.1 | 1 |
| gluufederation/ | fe944d2e5d0f | opentelemetry-api | 1.45.1 | 1 |
| grafana/ | 159b6b836fed | opentelemetry-api | 1.45.1 | 1 |
| grafana/ | 499851658393 | opentelemetry-api | 1.45.1 | 1 |
| growthbook/ | c8a124f55dca | opentelemetry-api | 1.45.1 | 1 |
| heartexlabs/ | afcc516a2277 | opentelemetry-api | 1.45.1 | 1 |
| helmforge/ | 61f759a1421f | opentelemetry-api | 1.45.1 | 1 |
| helmforge/ | fcb7017327d6 | opentelemetry-api | 1.45.1 | 1 |
| homeassistant/ | 5a531753cea9 | opentelemetry-api | 1.45.1 | 1 |
| homeassistant/ | a21689ef0510 | opentelemetry-api | 1.45.1 | 1 |
| intelowlproject/ | 0b22e547ea6b | opentelemetry-api | 1.45.1 | 1 |
| kenchrcum/ | 84dae7aeea5b | opentelemetry-api | 1.45.1 | 1 |
| kenchrcum/ | ce657c622ce5 | opentelemetry-api | 1.45.1 | 1 |
| labs64/ | 5e8e0e445588 | opentelemetry-api | 1.45.1 | 1 |
| labs64/ | ca10a23eb826 | opentelemetry-api | 1.45.1 | 1 |
| labs64/ | 7c45887d4ab7 | opentelemetry-api | 1.45.1 | 1 |
| langgenius/ | bdb2ed516bd3 | opentelemetry-api | 1.45.1 | 1 |