CVE-2026-39882
MediumAdvisory
Published 8 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.002
- 9th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 286
- of 17,781 indexed, latest versions
- Container images
- 274
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies
Carried by container images the latest versions of 286 of 17,781 indexed charts deploy, on 274 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.0.0, v1.3.0, v1.4.1, v1.6.3+35 more | 1.43.0 | 253 |
| go.opentelemetry.io/ | v0.31.0, v0.36.0, v0.39.0, v0.40.0+23 more | 1.43.0 | 123 |
| go.opentelemetry.io/ | v0.4.0, v0.5.0, v0.6.0, v0.7.0+10 more | 0.19.0 | 66 |
- OSV records
- GHSA-w8rr-5gcm-pp58
- Also known as
- GO-2026-4985
Charts affected
286 by stars
Container images carrying it
274 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| aibrix/ | 76aabbbfda79 | go.opentelemetry.io/ | 1.43.0 | 1 |
| aibrix/ | 5b93ea4c753a | go.opentelemetry.io/ | 1.43.0 | 1 |
| amazon/ | 73b79b02f03a | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| appwrite/ | 1aaa70127114 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| appwrite/ | adc7d0e7ec23 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| artifacthub/ | 6596c8c4d955 | go.opentelemetry.io/ | 1.43.0 | 1 |
| bitnamilegacy/ | 08b1b7cb6a5b | go.opentelemetry.io/ | 1.43.0 | 1 |
| bitnamilegacy/ | 5bf82b98c82c | go.opentelemetry.io/ | 1.43.0 | 1 |
| daprio/ | 4be696707bd1 | go.opentelemetry.io/ | 1.43.0 | 1 |
| daprio/ | 7ba5d51e5b97 | go.opentelemetry.io/ | 1.43.0 | 1 |
| darthsim/ | 3b709e4a0e5e | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| darthsim/ | 40f6eb807444 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| darthsim/ | 476cb08c816a | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| darthsim/ | 7d12c7c8fc66 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| datadog/ | aad9994de6a7 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| deepflowce/ | 34fcc526dd59 | go.opentelemetry.io/ | 1.43.0 | 1 |
| devopsfaith/ | 4c678c224f67 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| devopsfaith/ | 9219cda867e2 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| dockerdaemon0901/ | 4e5bfe179c7e | go.opentelemetry.io/ | 1.43.0 | 1 |
| elastiflow/ | fee67842e16b | go.opentelemetry.io/ | 1.43.0 | 1 |
| emqxecp/ | 4c31d9bec846 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| envoyproxy/ | 5966cbc14d5d | go.opentelemetry.io/ | 1.43.0 | 1 |
| ethereum/ | 37575ec10fbc | go.opentelemetry.io/ | 1.43.0 | 1 |
| ethereum/ | b8ab3451a117 | go.opentelemetry.io/ | 1.43.0 | 1 |
| ethpandaops/ | c0b30fcf64bc | go.opentelemetry.io/ | 1.43.0 | 1 |
| falcosecurity/ | 1976da721518 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| flanksource/ | 689687a7cf95 | go.opentelemetry.io/ | 1.43.0 | 1 |
| gitea/ | 6120b1165f3a | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| goharbor/ | 6412d679fdc3 | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | 86bf3031f4a7 | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | a30e5a8be3d9 | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | c017dd84ee96 | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | 39435daedd0c | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | 8d5339ff2d74 | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | e2b0298e894d | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | 7f82ed1e2635 | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | cce272836449 | go.opentelemetry.io/ | 1.43.0 | 1 |
| goharbor/ | ddf6bb429eb6 | go.opentelemetry.io/ | 1.43.0 | 1 |
| gotenberg/ | 206a6c708fc6 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| grafana/ | 3364714a2f64 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| grafana/ | f6cbec9409be | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| grafana/ | 01a63f4e032c | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| grafana/ | 06bdcbb51fc2 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| grafana/ | 8c7256f412fe | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| grafana/ | c3dac4e26471 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| grafana/ | f50931848bd8 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| grafana/ | 36d07f8d276e | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| grafana/ | 0f86bada30d6 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| grafana/ | 2d1f9ae67c17 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| grafana/ | 2ebef928d7e5 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |