StackRadar

CVE-2026-39882

Medium

Advisory

Published 8 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
286
of 17,781 indexed, latest versions
Container images
274
deployed by those charts
Fix available
3 of 3
affected packages

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

Carried by container images the latest versions of 286 of 17,781 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpgolangv1.0.0, v1.3.0, v1.4.1, v1.6.3+35 more1.43.0253
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttpgolangv0.31.0, v0.36.0, v0.39.0, v0.40.0+23 more1.43.0123
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpgolangv0.4.0, v0.5.0, v0.6.0, v0.7.0+10 more0.19.066
OSV records
GHSA-w8rr-5gcm-pp58
Also known as
GO-2026-4985

Charts affected

286 by stars
ChartLatestAffected imagesRadar Score
mw-autoinstrumentationmiddleware-labsVerified publisher1.2.61 of 6See more

mw-autoinstrumentation middleware-labs 1.2.6

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator:0.132.05e331c925091
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.13.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
0.19.0
1.43.0
1.43.0

Open the chart page →

3,713
mw-kube-agentmiddleware-labsVerified publisher0.1.21 of 1See more

mw-kube-agent middleware-labs 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.16.0
1.43.0
1.43.0

Open the chart page →

1,594
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:20.10-dindaf96c680a7e1
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

10,603
cognativemyaVerified publisher0.2403.31 of 3See more

cognative mya 0.2403.3

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.24.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.24.0
1.43.0
1.43.0

Open the chart page →

7,309
firehose-ethereumnodeifyVerified publisher1.7.11 of 2See more

firehose-ethereum nodeify 1.7.1

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/streamingfast/go-ethereum:geth-v1.16.9-fh3.08e3cb38953a3
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0

Open the chart page →

5,565
prometheusnodepulse25.0.01 of 6See more

prometheus nodepulse 25.0.0

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.47.0c5dd35038287
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.16.0
1.43.0

Open the chart page →

7,740
kafka-helm-chartnotesprojectchart0.1.01 of 1See more

kafka-helm-chart notesprojectchart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
wurstmeister/kafka:latest2d4bbf9cc83d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

4,547
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
linuxserver/cloud9:latest45c5fe102ff3
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.3.0
1.43.0

Open the chart page →

27,465
lensoci-ai-incubations0.1.142 of 16See more

lens oci-ai-incubations 0.1.14

2 of the 16 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.1.1a1701c218024
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
0.19.0
1.43.0
1.43.0
quay.io/prometheus/prometheus:v3.5.063805ebb8d2b
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0

Open the chart page →

17,070
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0
1.43.0
1.43.0

Open the chart page →

6,037
onyx-stackonyx0.3.12 of 12See more

onyx-stack onyx 0.3.1

2 of the 12 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.17.272dc058e478d
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
1.43.0
ghcr.io/kedacore/keda-metrics-apiserver:2.17.2f312f50ddc57
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
1.43.0

Open the chart page →

6,338
probuilderopenfaas0.2.01 of 2See more

probuilder openfaas 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
moby/buildkit:v0.10.0c2aeafaed434
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

4,751
openlitopenlit1.24.01 of 3See more

openlit openlit 1.24.0

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit:1.24.02434560e8f0e
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.14.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
0.19.0
1.43.0
1.43.0

Open the chart page →

5,017
openlit-operatoropenlit0.2.21 of 1See more

openlit-operator openlit 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/openlit/openlit-operator:0.0.2457bb5ada68b
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.7.0
0.19.0

Open the chart page →

851
opscruiseopenshift0.35.1001 of 11See more

opscruise openshift 0.35.100

1 of the 11 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.36.2df0cd5887887
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0

Open the chart page →

8,201
voyager-gatewayopenshift2026.1.151 of 2See more

voyager-gateway openshift 2026.1.15

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/voyagermesh/gateway:v1.6.223f4da194134
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
1.43.0

Open the chart page →

2,567
openvscode-serveropenvscode-server-helmVerified publisher2.7.371 of 2See more

openvscode-server openvscode-server-helm 2.7.37

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:23.0.1-dindd9a0fd8bdd15
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

4,237
agentoptimizely-agentVerified publisher1.4.01 of 1See more

agent optimizely-agent 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
optimizely/agent:4.0.09d0096cabd63
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

1,213
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
prom/prometheus:v3.0.1565ee8650122
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.30.0
1.43.0

Open the chart page →

71,208
vm-standaloneot-container-kit0.0.41 of 6See more

vm-standalone ot-container-kit 0.0.4

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/opstree/grafana:12.4.3b61c1ed2f015
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
0.19.0

Open the chart page →

3,378
adotowan-charts0.1.01 of 1See more

adot owan-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
public.ecr.aws/aws-observability/aws-otel-collector:v0.43.38aa9ea5f67b8
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.7.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.32.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.32.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,016
arpap2p-avs0.1.31 of 2See more

arpa p2p-avs 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/arpa-network/node-client:latest657a2c9f6e6d
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.25.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.25.0
1.43.0
1.43.0

Open the chart page →

1,980
parcaparca4.19.02 of 2See more

parca parca 4.19.0

2 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca:v0.20.00d1df8f436f7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.18.0
1.43.0
ghcr.io/parca-dev/parca-agent:v0.28.06d6794f45f3e
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

3,350
parcaparca-chart0.1.01 of 1See more

parca parca-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca:v0.20.00d1df8f436f7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.18.0
1.43.0

Open the chart page →

1,978
parcaparca-rr0.1.02 of 2See more

parca parca-rr 0.1.0

2 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/parca-dev/parca:v0.24.23776500fde82
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0
ghcr.io/parca-dev/parca-agent:v0.42.0adc0eeb4dd05
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0

Open the chart page →

2,366
pmm-ha-dependenciespercona1.0.01 of 4See more

pmm-ha-dependencies percona 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
percona/percona-postgresql-operator:2.8.06cce2698d3f5
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0

Open the chart page →

2,431
pipekit-agentpipekit-helmOfficialVerified publisher7.6.01 of 1See more

pipekit-agent pipekit-helm 7.6.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
pipekit13/agent:v7.6.0c3f01b5ac3b2
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.16.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.40.0
0.19.0
1.43.0

Open the chart page →

103
beylaportefaix-hub0.1.01 of 1See more

beyla portefaix-hub 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/beyla:1.3.336d07f8d276e
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.23.1
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.23.1
1.43.0
1.43.0

Open the chart page →

2,664
hydraradar-baseVerified publisher0.48.01 of 1See more

hydra radar-base 0.48.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/hydra:v2.2.02c93beb5e5f2
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

1,524
kratosradar-baseVerified publisher0.43.11 of 1See more

kratos radar-base 0.43.1

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/kratos:v1.1.08f15006a080d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

1,776
kubecostradar-baseVerified publisher1.0.01 of 7See more

kubecost radar-base 1.0.0

1 of the 7 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.2.05888c188cf09
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0

Open the chart page →

9,355
radar-grafanaradar-baseVerified publisher0.1.41 of 2See more

radar-grafana radar-base 0.1.4

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:11.6.062d2b9d20a19
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0

Open the chart page →

1,667
radar-hydraradar-baseVerified publisher0.3.41 of 2See more

radar-hydra radar-base 0.3.4

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/hydra:v2.3.0b94007e19a1f
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.32.0
1.43.0

Open the chart page →

2,177
radar-kratosradar-baseVerified publisher0.1.51 of 1See more

radar-kratos radar-base 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
oryd/kratos:v1.3.1fe2428f103a6
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0

Open the chart page →

1,561
rancher-auto-registerrancher-auto-registerVerified publisher0.1.01 of 1See more

rancher-auto-register rancher-auto-register 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,837
thanosrayselfs-chartsVerified publisher0.1.51 of 1See more

thanos rayselfs-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.40.1aae7b2b030ed
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0

Open the chart page →

750
imgproxyrock8sVerified publisher0.8.301 of 1See more

imgproxy rock8s 0.8.30

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.15.040f6eb807444
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.36.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.13.0
1.43.0
1.43.0

Open the chart page →

2,022
monitoringrocketchat-server0.0.172 of 9See more

monitoring rocketchat-server 0.0.17

2 of the 9 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/loki:3.6.3cd6e176883a9
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
0.19.0
1.43.0
1.43.0
otel/opentelemetry-collector-contrib:0.143.03bc07732530c
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.14.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
0.19.0
1.43.0
1.43.0

Open the chart page →

6,859
jaegerromanow-helm-chartsVerified publisher1.7.31 of 1See more

jaeger romanow-helm-charts 1.7.3

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
jaegertracing/jaeger:2.9.0e128b9adbb29
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.13.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,597
devtron-enterpriseromholdings48.0.01 of 28See more

devtron-enterprise romholdings 48.0.0

1 of the 28 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:09867a9c-419-39288d30a7c640c63
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0

Open the chart page →

68,240
grafanasb-helm-charts0.4.01 of 1See more

grafana sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.2.22ebef928d7e5
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,795
harborsb-helm-charts0.3.01 of 2See more

harbor sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.11.1c017dd84ee96
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.26.0
1.43.0

Open the chart page →

1,680
lokisb-helm-charts0.4.01 of 1See more

loki sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/loki:3.6.192bd5700577b
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
0.19.0
1.43.0
1.43.0

Open the chart page →

803
opentelemetry-collectorsb-helm-charts0.3.01 of 1See more

opentelemetry-collector sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.96.07ef2a2ff46b9
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.24.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.24.0
1.43.0
1.43.0

Open the chart page →

1,721
promtailsb-helm-charts0.4.01 of 1See more

promtail sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/promtail:3.6.18dcfdf466da0
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
0.19.0
1.43.0
1.43.0

Open the chart page →

2,202
temposb-helm-charts0.4.01 of 1See more

tempo sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/tempo:2.9.065a578975943
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.13.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

923
thanos-compactorsb-helm-charts0.3.01 of 1See more

thanos-compactor sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

961
thanos-querysb-helm-charts0.3.01 of 1See more

thanos-query sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

961
thanos-query-frontendsb-helm-charts0.3.01 of 1See more

thanos-query-frontend sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

961

Container images carrying it

274 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/argoproj/workflow-controller:v3.7.11c46aa0ded8ed
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/cortexproject/cortex:v1.21.18577eb292a01
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/kiali/kiali:v1.89.30dcdb1c1e747
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.22.0
1.43.0
1
quay.io/kiali/kiali:v2.23.07652b1285f50
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
0.19.0
1
quay.io/projectquay/clair:4.9.023329c3368e4
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.32.058e117eabcce
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.31.188b605de9aba
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.30.0
1.43.0
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.10.0
1.43.0
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.05888c188cf09
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.5.063805ebb8d2b
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.16927e0919a14
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0
1
quay.io/prometheus/prometheus:v3.11.3c0b857aead0d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v3.11.2cd37346c9745
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
quay.io/thanos/thanos:v0.40.1aae7b2b030ed
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.