StackRadar

CVE-2026-39882

Medium

Advisory

Published 8 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
286
of 17,781 indexed, latest versions
Container images
274
deployed by those charts
Fix available
3 of 3
affected packages

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

Carried by container images the latest versions of 286 of 17,781 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpgolangv1.0.0, v1.3.0, v1.4.1, v1.6.3+35 more1.43.0253
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttpgolangv0.31.0, v0.36.0, v0.39.0, v0.40.0+23 more1.43.0123
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpgolangv0.4.0, v0.5.0, v0.6.0, v0.7.0+10 more0.19.066
OSV records
GHSA-w8rr-5gcm-pp58
Also known as
GO-2026-4985

Charts affected

286 by stars
ChartLatestAffected imagesRadar Score
pyroscope-monitoringgrafana0.1.11 of 6See more

pyroscope-monitoring grafana 0.1.1

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/otel-lgtm:0.11.1009d8c3ce4f3a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.11.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
0.19.0
1.43.0
1.43.0

Open the chart page →

8,188
prometheusgrafana-uxadax26.0.11 of 6See more

prometheus grafana-uxadax 26.0.1

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
prom/prometheus:v3.0.1565ee8650122
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.30.0
1.43.0

Open the chart page →

5,304
armada-executorgresearch0.22.81 of 1See more

armada-executor gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
gresearch/armada-executor:latest393aff4aa8f2
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

707
armada-lookout-ingestergresearch0.22.81 of 1See more

armada-lookout-ingester gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
gresearch/armada-lookout-ingester:latest3df14cda1855
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

707
armada-lookout-migrationgresearch0.22.81 of 1See more

armada-lookout-migration gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
gresearch/armada-lookout:latestf5e3226f1d33
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

707
armada-scheduler-migrationgresearch0.22.81 of 1See more

armada-scheduler-migration gresearch 0.22.8

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
gresearch/armada-scheduler:latest6141a6213fcb
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

707
act-runnergringolitoVerified publisher0.2.01 of 1See more

act-runner gringolito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
gitea/act_runner:0.2.11-dind-rootless6120b1165f3a
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0
1.43.0

Open the chart page →

2,590
heliconehelicone0.1.421 of 14See more

helicone helicone 0.1.42

1 of the 14 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
supabase/gotrue:v2.91.07174d551d720
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.10.0
1.43.0
1.43.0

Open the chart page →

24,995
hello_worldcharthellohelm0.1.01 of 1See more

hello_worldchart hellohelm 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
dockerdaemon0901/rolldice:v14e5bfe179c7e
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

848
helm-airportshelm-airports0.1.01 of 7See more

helm-airports helm-airports 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

12,696
airports-kafkahelm-airports-dan0.1.01 of 2See more

airports-kafka helm-airports-dan 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

4,547
helm-airportshelm-airports-dan0.1.01 of 7See more

helm-airports helm-airports-dan 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

5,573
airports-kafkahelm-airports-kafka0.1.01 of 2See more

airports-kafka helm-airports-kafka 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

4,547
monitoring-stackhelm-charts-alexis-carbillet0.1.01 of 11See more

monitoring-stack helm-charts-alexis-carbillet 0.1.0

1 of the 11 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
prom/prometheus:v2.48.1a67e5e402ff5
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
1.43.0

Open the chart page →

9,460
appwritehelmforgeVerified publisher1.3.41 of 5See more

appwrite helmforge 1.3.4

1 of the 5 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
appwrite/appwrite:1.9.6adc7d0e7ec23
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
1.43.0

Open the chart page →

6,952
monitoring-stackict-platformVerified publisher0.4.01 of 13See more

monitoring-stack ict-platform 0.4.0

1 of the 13 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/loki:3.6.73c8fd3570dd9
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
0.19.0
1.43.0
1.43.0

Open the chart page →

9,573
ilum-otel-collectorilumVerified publisher0.1.01 of 1See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.7.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,384
hetzner-dyndnsitsmethemojoVerified publisher1.4.01 of 1See more

hetzner-dyndns itsmethemojo 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
hashicorp/terraform:1.9.7b77efab1a448
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
1.43.0

Open the chart page →

1,836
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.23.1
1.43.0
1.43.0

Open the chart page →

3,999
thanosk8sonlabVerified publisher1.1.71 of 1See more

thanos k8sonlab 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
thanosio/thanos:v0.41.0cf3e9b292e43
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0

Open the chart page →

592
kagentkagent0.10.11 of 6See more

kagent kagent 0.10.1

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.16.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.40.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.40.0
0.19.0
1.43.0
1.43.0

Open the chart page →

2,900
dockerdkarljorgensen0.1.01 of 1See more

dockerd karljorgensen 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:28.5.2-dind2a232a42256f
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
1.43.0

Open the chart page →

2,034
kbot-self-hostedkbot-self-hostedVerified publisher0.1.81 of 7See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.30206a6c708fc6
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0

Open the chart page →

32,509
mysqldumpkfirfer2.8.01 of 1See more

mysqldump kfirfer 2.8.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
kfirfer/gcloud-mysql:1.0.3c257c1e0e8b9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.14.0
1.43.0

Open the chart page →

3,507
prometheuskubeblocksVerified publisher15.16.11 of 6See more

prometheus kubeblocks 15.16.1

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.39.14748e26f9369
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.10.0
1.43.0

Open the chart page →

10,302
harborkubesphereVerified publisher1.9.33 of 11See more

harbor kubesphere 1.9.3

3 of the 11 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.5.386bf3031f4a7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.0.0
1.43.0
goharbor/harbor-jobservice:v2.5.38d5339ff2d74
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.0.0
1.43.0
goharbor/harbor-registryctl:v2.5.37f82ed1e2635
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.0.0
1.43.0

Open the chart page →

17,798
deepflowkubesphere-stable6.2.6061 of 8See more

deepflow kubesphere-stable 6.2.606

1 of the 8 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
deepflowce/deepflow-server:v6.2.6.534fcc526dd59
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0

Open the chart page →

18,316
easegresskubesphere-stable1.0.01 of 1See more

easegress kubesphere-stable 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
megaease/easegress:latestfad1c7452958
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
1.43.0

Open the chart page →

1,308
kubiya-runnerkubiya-helm-chartsOfficialVerified publisher0.9.42 of 9See more

kubiya-runner kubiya-helm-charts 0.9.4

2 of the 9 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/alloy:v1.5.101a63f4e032c
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.7.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0
0.19.0
1.43.0
1.43.0
ghcr.io/kubiyabot/tool-manager:0.5.80cca6760763a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.32.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
0.19.0
1.43.0
1.43.0

Open the chart page →

20,204
krakendkvalitetsitVerified publisher0.0.31 of 1See more

krakend kvalitetsit 0.0.3

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
devopsfaith/krakend:latestf8bdaa8a1a43
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.28.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0
1.43.0

Open the chart page →

1,242
lagoon-docker-hostlagoon-chartsVerified publisher0.7.01 of 1See more

lagoon-docker-host lagoon-charts 0.7.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
uselagoon/docker-host:v3.6.12c89ed939b8b
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0
1.43.0
1.43.0

Open the chart page →

2,113
lambdapinglambdaping1.0.41 of 1See more

lambdaping lambdaping 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
udhos/lambdaping:1.0.46bd2cf2ac732
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

1,330
prometheuslectures-k8sinfra15.8.51 of 6See more

prometheus lectures-k8sinfra 15.8.5

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0

Open the chart page →

9,092
lightsteplightstep-microsat2.0.211 of 1See more

lightstep lightstep-microsat 2.0.21

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
lightstep/microsatellite:2024-01-22_17-52-59Zc800e05e1eff
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.23.0
1.43.0

Open the chart page →

1,116
linkerd-preview-vizlinkerd-buoyantVerified publisher25.4.31 of 5See more

linkerd-preview-viz linkerd-buoyant 25.4.3

1 of the 5 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/buoyantio/prometheus:v2.55.12659f4c2ebb7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

3,420
linkerd-dashboardlinkerd-dashboardOfficial0.11.11 of 2See more

linkerd-dashboard linkerd-dashboard 0.11.1

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/buoyantio/prometheus:v3.3.1e2b8aa62b648
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0

Open the chart page →

1,037
tempo-distributedloafoe1.20.11 of 2See more

tempo-distributed loafoe 1.20.1

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/tempo:2.6.0f55a8a1937ff
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.27.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0
1.43.0

Open the chart page →

2,020
devpod-proloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

devpod-pro loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

3,225
vcluster-control-planeloftVerified publisher0.0.0-ci.4-do-not-use1 of 1See more

vcluster-control-plane loft 0.0.0-ci.4-do-not-use

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

3,225
vcluster-proloftVerified publisher0.0.0-ci-run.101 of 2See more

vcluster-pro loft 0.0.0-ci-run.10

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
rancher/k3s:v1.26.0-k3s19380f5dbae9a
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.3.0
1.43.0

Open the chart page →

5,085
nightingalelogic3579Verified publisher0.3.11 of 6See more

nightingale logic3579 0.3.1

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.54.1f6639335d34a
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

8,938
apica-ascentlogiqai2.0.41 of 19See more

apica-ascent logiqai 2.0.4

1 of the 19 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
logiqai/flash:v3.10.265b996bc7bdc
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.44.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0
1.43.0

Open the chart page →

23,613
ratelimitlumiumcoVerified publisher0.0.41 of 2See more

ratelimit lumiumco 0.0.4

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
envoyproxy/ratelimit:a90e0e5d5966cbc14d5d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0

Open the chart page →

1,001
magistralamagistrala-devopsVerified publisher0.16.21 of 42See more

magistrala magistrala-devops 0.16.2

1 of the 42 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

24,400
matrix-sliding-syncmatrix-sliding-sync0.2.31 of 1See more

matrix-sliding-sync matrix-sliding-sync 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/matrix-org/sliding-sync:v0.99.19b940cab56435
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.18.0
1.43.0

Open the chart page →

1,592
mayastormayastorVerified publisher2.12.11 of 31See more

mayastor mayastor 2.12.1

1 of the 31 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/alloy:v1.8.17790f6f7fbd8
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.11.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
0.19.0
1.43.0
1.43.0

Open the chart page →

21,064
mdai-gatewaymdai-gatewayVerified publisher0.1.101 of 1See more

mdai-gateway mdai-gateway 0.1.10

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
public.ecr.aws/p3k6k6h3/mdai-gateway:0.1.100dfb323978f6
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0

Open the chart page →

402
mdai-hubmdai-hubVerified publisher0.10.12 of 14See more

mdai-hub mdai-hub 0.10.1

2 of the 14 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.148.0590e50477b76
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0
public.ecr.aws/p3k6k6h3/mdai-gateway:0.1.100dfb323978f6
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0

Open the chart page →

4,742
prometheus-operatormesosphere12.11.131 of 8See more

prometheus-operator mesosphere 12.11.13

1 of the 8 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.3.39e1e77ade304
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

11,689
kube-prometheus-stackmesosphere-stable75.9.11 of 7See more

kube-prometheus-stack mesosphere-stable 75.9.1

1 of the 7 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.0.2b5b59bfc7561
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0

Open the chart page →

10,180

Container images carrying it

274 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/argoproj/workflow-controller:v3.7.11c46aa0ded8ed
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/cortexproject/cortex:v1.21.18577eb292a01
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/kiali/kiali:v1.89.30dcdb1c1e747
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.22.0
1.43.0
1
quay.io/kiali/kiali:v2.23.07652b1285f50
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
0.19.0
1
quay.io/projectquay/clair:4.9.023329c3368e4
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.32.058e117eabcce
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.31.188b605de9aba
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.30.0
1.43.0
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.10.0
1.43.0
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.05888c188cf09
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.5.063805ebb8d2b
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.16927e0919a14
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0
1
quay.io/prometheus/prometheus:v3.11.3c0b857aead0d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v3.11.2cd37346c9745
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
quay.io/thanos/thanos:v0.40.1aae7b2b030ed
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.