StackRadar

CVE-2026-39882

Medium

Advisory

Published 8 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
286
of 17,781 indexed, latest versions
Container images
274
deployed by those charts
Fix available
3 of 3
affected packages

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

Carried by container images the latest versions of 286 of 17,781 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpgolangv1.0.0, v1.3.0, v1.4.1, v1.6.3+35 more1.43.0253
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttpgolangv0.31.0, v0.36.0, v0.39.0, v0.40.0+23 more1.43.0123
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpgolangv0.4.0, v0.5.0, v0.6.0, v0.7.0+10 more0.19.066
OSV records
GHSA-w8rr-5gcm-pp58
Also known as
GO-2026-4985

Charts affected

286 by stars
ChartLatestAffected imagesRadar Score
argo-eventsargoOfficialVerified publisher2.4.271 of 1See more

argo-events argo 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0

Open the chart page →

969
openebsopenebsOfficialVerified publisher4.6.11 of 35See more

openebs openebs 4.6.1

1 of the 35 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.11.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
0.19.0
1.43.0
1.43.0

Open the chart page →

23,894
linkerd-vizlinkerd2Verified publisher30.12.111 of 5See more

linkerd-viz linkerd2 30.12.11

1 of the 5 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
prom/prometheus:v2.48.0b440bc0e8aa5
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
1.43.0

Open the chart page →

1,367
atlantisatlantis6.15.01 of 1See more

atlantis atlantis 6.15.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/runatlantis/atlantis:v0.47.1511231955463
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,891
grafana-agentgrafana0.44.21 of 2See more

grafana-agent grafana 0.44.2

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/agent:v0.44.23364714a2f64
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.24.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.24.0
1.43.0
1.43.0

Open the chart page →

3,475
vclusterloftVerified publisher0.0.0-ci.31 of 2See more

vcluster loft 0.0.0-ci.3

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
rancher/k3s:v1.26.0-k3s19380f5dbae9a
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.3.0
1.43.0

Open the chart page →

2,453
semaphoresemaphoreuiOfficialVerified publisher16.2.21 of 1See more

semaphore semaphoreui 16.2.2

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.18.3e9260bfa8255
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.14.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
0.19.0
1.43.0
1.43.0

Open the chart page →

2,221
pulsarapache4.7.01 of 10See more

pulsar apache 4.7.0

1 of the 10 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.4.1e932bd6ed0e0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
0.19.0
1.43.0
1.43.0

Open the chart page →

9,864
pyroscopegrafana2.3.11 of 3See more

pyroscope grafana 2.3.1

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/alloy:v1.12.2f94b1c82957a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.14.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

3,157
hydraory0.64.01 of 2See more

hydra ory 0.64.0

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/hydra:v26.2.0ff67c7fb5f95
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0

Open the chart page →

1,156
kratosory0.64.01 of 1See more

kratos ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/kratos:v26.2.02a13bb8d362c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0

Open the chart page →

866
aws-cloudwatch-metricsaws0.0.111 of 1See more

aws-cloudwatch-metrics aws 0.0.11

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
amazon/cloudwatch-agent:1.300032.2b36173b79b02f03a
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.40.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.17.0
1.43.0
1.43.0

Open the chart page →

1,556
imgproxyimgproxy1.1.01 of 1See more

imgproxy imgproxy 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/imgproxy/imgproxy:v3.30.074c1bee92e04
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0
1.43.0

Open the chart page →

2,321
falcosidekickfalcosecurity0.14.01 of 1See more

falcosidekick falcosecurity 0.14.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
falcosecurity/falcosidekick:2.32.01976da721518
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.10.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,633
linkerd-vizlinkerd2-edgeVerified publisher30.14.11-edge1 of 5See more

linkerd-viz linkerd2-edge 30.14.11-edge

1 of the 5 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
prom/prometheus:v2.48.1a67e5e402ff5
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
1.43.0

Open the chart page →

1,346
ansible-semaphorecloudhippieVerified publisher15.2.101 of 1See more

ansible-semaphore cloudhippie 15.2.10

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
semaphoreui/semaphore:v2.19.1498ad9bc7a2a0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.14.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,235
supabasetokens-studioVerified publisher1.0.02 of 14See more

supabase tokens-studio 1.0.0

2 of the 14 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.26476cb08c816a
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0
1.43.0
1.43.0
supabase/gotrue:v2.163.0ba4ddc594b0b
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.26.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
1.43.0
1.43.0

Open the chart page →

23,123
k8s-infrasignoz0.17.11 of 1See more

k8s-infra signoz 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.139.0faf125d656fa
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.14.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,039
cortexcortex3.3.81 of 4See more

cortex cortex 3.3.8

1 of the 4 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/cortexproject/cortex:v1.21.18577eb292a01
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0

Open the chart page →

3,897
gethethereum-helm-chartsVerified publisher1.1.41 of 2See more

geth ethereum-helm-charts 1.1.4

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ethereum/client-go:stableb8ab3451a117
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0

Open the chart page →

616
ketoory0.64.01 of 1See more

keto ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/keto:v26.2.0bfdb8b9e283a
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0

Open the chart page →

817
oathkeeperory0.64.01 of 1See more

oathkeeper ory 0.64.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/oathkeeper:v26.2.0467329abde34
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0

Open the chart page →

769
routercosmo-routerOfficialVerified publisher0.18.01 of 1See more

router cosmo-router 0.18.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/router:0.243.05afcab98d9d7
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.23.1
1.43.0
1.43.0

Open the chart page →

1,663
drone-runner-dockerdroneVerified publisher0.7.01 of 3See more

drone-runner-docker drone 0.7.0

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:20-dindaf96c680a7e1
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

5,674
prometheusaveshaVerified publisher19.3.01 of 4See more

prometheus avesha 19.3.0

1 of the 4 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.11.2
1.43.0

Open the chart page →

5,484
coder-observabilitycoder-observabilityVerified publisher0.7.33 of 21See more

coder-observability coder-observability 0.7.3

3 of the 21 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
1.43.0
1.43.0
grafana/grafana:10.4.19a9043254ba16
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0

Open the chart page →

24,700
cosmocosmo-platformOfficialVerified publisher0.20.01 of 10See more

cosmo cosmo-platform 0.20.0

1 of the 10 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.27.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1.43.0

Open the chart page →

28,839
dapr-dashboarddapr0.15.01 of 1See more

dapr-dashboard dapr 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
daprio/dashboard:0.15.04be696707bd1
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

1,301
bscdysnixVerified publisher0.6.591 of 4See more

bsc dysnix 0.6.59

1 of the 4 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/bnb-chain/bsc:1.6.2fd0e3ec7d960
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0

Open the chart page →

2,012
coreinstill-aiOfficialVerified publisher0.1.751 of 15See more

core instill-ai 0.1.75

1 of the 15 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
instill/api-gateway:9bfdc88b53eaa51c523
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.28.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0
1.43.0

Open the chart page →

30,816
vcluster-platformloftVerified publisher4.12.01 of 1See more

vcluster-platform loft 4.12.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-platform:4.12.0ef92da4621e6
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0

Open the chart page →

744
kubecostmesosphere-stable0.37.52 of 9See more

kubecost mesosphere-stable 0.37.5

2 of the 9 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.55.0378f4e037035
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0

Open the chart page →

17,693
oesopsmxVerified publisher4.0.321 of 25See more

oes opsmx 4.0.32

1 of the 25 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0

Open the chart page →

107,811
ipfs-clusterparadeum-teamVerified publisher0.0.191 of 2See more

ipfs-cluster paradeum-team 0.0.19

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ipfs/go-ipfs:v0.13.117259397f587
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0

Open the chart page →

3,757
permifypermifyVerified publisher0.5.01 of 1See more

permify permify 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/permify/permify:v1.3.5f0c6f7d7daa6
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
1.43.0

Open the chart page →

997
bentoself-hosters-by-nightVerified publisher0.9.11 of 1See more

bento self-hosters-by-night 0.9.1

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/warpstreamlabs/bento:1.8.121715979aefa
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.23.1
1.43.0

Open the chart page →

1,046
sn-platformstreamnative1.11.441 of 9See more

sn-platform streamnative 1.11.44

1 of the 9 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.14.0
1.43.0

Open the chart page →

15,477
feedbacksystemthm-mni-iiVerified publisher0.47.12 of 10See more

feedbacksystem thm-mni-ii 0.47.1

2 of the 10 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:20.10.21-dind3153fa63f546
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0
thmmniii/fbs-runner:v1.27.186105349c1a3
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.14.0
1.43.0

Open the chart page →

28,534
uptraceuptrace2.0.21 of 2See more

uptrace uptrace 2.0.2

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
uptrace/uptrace:2.0.234a02c3b2d12
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.13.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,619
agentareaagentareaVerified publisher0.0.181 of 16See more

agentarea agentarea 0.0.18

1 of the 16 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

14,914
alertmanager-matrixalertmanager-matrixVerified publisher0.1.161 of 1See more

alertmanager-matrix alertmanager-matrix 0.1.16

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
silkeh/alertmanager_matrix:0.6.1900010497f8c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0

Open the chart page →

454
clearml-servingallegroaiVerified publisher1.6.21 of 9See more

clearml-serving allegroai 1.6.2

1 of the 9 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.11.2
1.43.0

Open the chart page →

17,877
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
prom/prometheus:v2.37.98176adea328e
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0

Open the chart page →

22,202
kedaarieotechVerified publisher0.1.02 of 3See more

keda arieotech 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.16.002348a19aeae
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.31.0
1.43.0
ghcr.io/kedacore/keda-metrics-apiserver:2.16.073a2ebae4413
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.31.0
1.43.0

Open the chart page →

2,276
astradnsastradnsVerified publisher0.2.91 of 2See more

astradns astradns 0.2.9

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/astradns/astradns-agent:v0.2.9-unbound6ba69487f1b0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0

Open the chart page →

2,613
buildkite-agent-metricsbuildkite-agent-metrics0.1.01 of 1See more

buildkite-agent-metrics buildkite-agent-metrics 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
public.ecr.aws/buildkite/agent-metrics:v5.11.016e7f5c7161e
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0
1.43.0

Open the chart page →

1,533
celestia-nodecelestia-node0.1.71 of 1See more

celestia-node celestia-node 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/celestiaorg/celestia-node:v0.16.041177982c584
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.27.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1.43.0

Open the chart page →

1,799
istio-allcode4devsVerified publisher1.2.02 of 6See more

istio-all code4devs 1.2.0

2 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/kiali/kiali:v1.89.30dcdb1c1e747
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.22.0
1.43.0
quay.io/prometheus/prometheus:v2.54.1f6639335d34a
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

4,784
aibrixdanchevVerified publisher0.7.02 of 5See more

aibrix danchev 0.7.0

2 of the 5 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
aibrix/controller-manager:v0.7.076aabbbfda79
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0
aibrix/gateway-plugins:v0.7.05b93ea4c753a
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

5,274
dbrepodbrepo1.13.31 of 25See more

dbrepo dbrepo 1.13.3

1 of the 25 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
bitnamilegacy/prometheus:2.54.1-debian-12-r408b1b7cb6a5b
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

52,635

Container images carrying it

274 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/argoproj/workflow-controller:v3.7.11c46aa0ded8ed
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/cortexproject/cortex:v1.21.18577eb292a01
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/kiali/kiali:v1.89.30dcdb1c1e747
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.22.0
1.43.0
1
quay.io/kiali/kiali:v2.23.07652b1285f50
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
0.19.0
1
quay.io/projectquay/clair:4.9.023329c3368e4
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.32.058e117eabcce
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.31.188b605de9aba
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.30.0
1.43.0
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.10.0
1.43.0
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.05888c188cf09
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.5.063805ebb8d2b
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.16927e0919a14
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0
1
quay.io/prometheus/prometheus:v3.11.3c0b857aead0d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v3.11.2cd37346c9745
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
quay.io/thanos/thanos:v0.40.1aae7b2b030ed
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.