CVE-2026-39882
MediumAdvisory
Published 8 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.002
- 9th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 286
- of 17,781 indexed, latest versions
- Container images
- 274
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies
Carried by container images the latest versions of 286 of 17,781 indexed charts deploy, on 274 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.0.0, v1.3.0, v1.4.1, v1.6.3+35 more | 1.43.0 | 253 |
| go.opentelemetry.io/ | v0.31.0, v0.36.0, v0.39.0, v0.40.0+23 more | 1.43.0 | 123 |
| go.opentelemetry.io/ | v0.4.0, v0.5.0, v0.6.0, v0.7.0+10 more | 0.19.0 | 66 |
- OSV records
- GHSA-w8rr-5gcm-pp58
- Also known as
- GO-2026-4985
Charts affected
286 by stars
Container images carrying it
274 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| oryd/ | ff67c7fb5f95 | go.opentelemetry.io/ | 1.43.0 | 1 |
| oryd/ | bfdb8b9e283a | go.opentelemetry.io/ | 1.43.0 | 1 |
| oryd/ | 2a13bb8d362c | go.opentelemetry.io/ | 1.43.0 | 1 |
| oryd/ | 8f15006a080d | go.opentelemetry.io/ | 1.43.0 | 1 |
| oryd/ | 467329abde34 | go.opentelemetry.io/ | 1.43.0 | 1 |
| otel/ | 9e36620d6c2c | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| otel/ | 37fa87091cfa | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| otel/ | 3bc07732530c | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| otel/ | 5ac3e0ba2b0b | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| otel/ | 71fcef33ae71 | go.opentelemetry.io/ | 1.43.0 | 1 |
| otel/ | 923eb1cfae32 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| otel/ | 995f17004231 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| otel/ | a7343f018690 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| otel/ | faf125d656fa | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| otel/ | 1e45d9483faa | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| percona/ | 6cce2698d3f5 | go.opentelemetry.io/ | 1.43.0 | 1 |
| pipekit13/ | c3f01b5ac3b2 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 | 1 |
| portainer/ | 3e61aaee1341 | go.opentelemetry.io/ | 1.43.0 | 1 |
| prom/ | 4f6c47e39a90 | go.opentelemetry.io/ | 1.43.0 | 1 |
| prom/ | b440bc0e8aa5 | go.opentelemetry.io/ | 1.43.0 | 1 |
| rancher/ | eaa270df79cc | go.opentelemetry.io/ | 1.43.0 | 1 |
| semaphoreui/ | 3996804607eb | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| semaphoreui/ | 98ad9bc7a2a0 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| semaphoreui/ | e9260bfa8255 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| silkeh/ | 900010497f8c | go.opentelemetry.io/ | 1.43.0 | 1 |
| supabase/ | 385184459f57 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| supabase/ | 7174d551d720 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| supabase/ | ba4ddc594b0b | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| thmmniii/ | 86105349c1a3 | go.opentelemetry.io/ | 1.43.0 | 1 |
| udhos/ | 41ab9bae6f3b | go.opentelemetry.io/ | 1.43.0 | 1 |
| udhos/ | 3acc0e7599bf | go.opentelemetry.io/ | 1.43.0 | 1 |
| udhos/ | 5567c9363c4c | go.opentelemetry.io/ | 1.43.0 | 1 |
| udhos/ | 6bd2cf2ac732 | go.opentelemetry.io/ | 1.43.0 | 1 |
| udhos/ | daa2b4eaac09 | go.opentelemetry.io/ | 1.43.0 | 1 |
| udhos/ | 6ae70677b6a3 | go.opentelemetry.io/ | 1.43.0 | 1 |
| uptrace/ | 34a02c3b2d12 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| ghcr.io/ | 4e0d4d51f0bc | go.opentelemetry.io/ | 1.43.0 | 1 |
| ghcr.io/ | 6e9ced773732 | go.opentelemetry.io/ | 1.43.0 | 1 |
| ghcr.io/ | 68e17a8aaa40 | go.opentelemetry.io/ | 1.43.0 | 1 |
| ghcr.io/ | 657a2c9f6e6d | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| ghcr.io/ | 6ba69487f1b0 | go.opentelemetry.io/ | 1.43.0 | 1 |
| ghcr.io/ | e0cdb993f0b1 | go.opentelemetry.io/ | 1.43.0 | 1 |
| ghcr.io/ | fd0e3ec7d960 | go.opentelemetry.io/ | 1.43.0 | 1 |
| ghcr.io/ | 54a193b757da | go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 | 1 |
| ghcr.io/ | e2b8aa62b648 | go.opentelemetry.io/ | 1.43.0 | 1 |
| ghcr.io/ | 41177982c584 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| ghcr.io/ | 8d35a64e4a99 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| ghcr.io/ | 269d0e55ea97 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |
| ghcr.io/ | 4ba3adf47f5c | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 1 |
| ghcr.io/ | f5654f745d4c | go.opentelemetry.io/ | 1.43.0 | 1 |