StackRadar

CVE-2026-39882

Medium

Advisory

Published 8 Apr 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.002
9th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
286
of 17,781 indexed, latest versions
Container images
274
deployed by those charts
Fix available
3 of 3
affected packages

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

Carried by container images the latest versions of 286 of 17,781 indexed charts deploy, on 274 images.

Affected packageAffected versionsFixed inImages
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttpgolangv1.0.0, v1.3.0, v1.4.1, v1.6.3+35 more1.43.0253
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttpgolangv0.31.0, v0.36.0, v0.39.0, v0.40.0+23 more1.43.0123
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttpgolangv0.4.0, v0.5.0, v0.6.0, v0.7.0+10 more0.19.066
OSV records
GHSA-w8rr-5gcm-pp58
Also known as
GO-2026-4985

Charts affected

286 by stars
ChartLatestAffected imagesRadar Score
thanos-receivesb-helm-charts0.3.01 of 1See more

thanos-receive sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

961
thanos-rulersb-helm-charts0.3.01 of 1See more

thanos-ruler sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

961
thanos-sidecarsb-helm-charts0.3.01 of 1See more

thanos-sidecar sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

961
thanos-storesb-helm-charts0.3.01 of 1See more

thanos-store sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/thanos/thanos:v0.37.24ec6df40fdb9
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.29.0
1.43.0

Open the chart page →

961
secretssecrets-proxy1.0.61 of 1See more

secrets secrets-proxy 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
udhos/secrets:1.0.6daa2b4eaac09
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0

Open the chart page →

987
semaphoresemaphore-light1.0.01 of 1See more

semaphore semaphore-light 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
semaphoreui/semaphore:latest3996804607eb
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.14.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,674
ccx-monitoringseveralnines0.6.211 of 7See more

ccx-monitoring severalnines 0.6.21

1 of the 7 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.3.12175aaa91c96
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

7,708
teamcitysinextraVerified publisher1.0.21 of 3See more

teamcity sinextra 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:26.1-dinddd43b430341a
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v0.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.21.0
1.43.0
1.43.0

Open the chart page →

2,429
network-observerskupper-network-observerVerified publisher2.2.21 of 3See more

network-observer skupper-network-observer 2.2.2

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.11.3c0b857aead0d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0

Open the chart page →

601
skypilot-prometheus-serverskypilotVerified publisher0.11.11 of 3See more

skypilot-prometheus-server skypilot 0.11.1

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0

Open the chart page →

2,344
smarter-k3s-edgesmarterVerified publisher0.0.121 of 2See more

smarter-k3s-edge smarter 0.0.12

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
rancher/k3s:v1.25.3-k3s1eaa270df79cc
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.3.0
1.43.0

Open the chart page →

3,462
snspingsnsping1.2.91 of 1See more

snsping snsping 1.2.9

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
udhos/snsping:1.2.96ae70677b6a3
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

1,326
cost-analyzersoftonic2.5.52 of 6See more

cost-analyzer softonic 2.5.5

2 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:11.5.28b37a2f028f1
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0
quay.io/prometheus/prometheus:v3.2.16927e0919a14
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0

Open the chart page →

7,901
harborsoftonic1.13.03 of 8See more

harbor softonic 1.13.0

3 of the 8 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.9.06412d679fdc3
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.3.0
1.43.0
goharbor/harbor-jobservice:v2.9.039435daedd0c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.3.0
1.43.0
goharbor/harbor-registryctl:v2.9.0cce272836449
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.3.0
1.43.0

Open the chart page →

7,672
kedasoftonic2.17.02 of 3See more

keda softonic 2.17.0

2 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/kedacore/keda:2.17.0112fc427d933
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
1.43.0
ghcr.io/kedacore/keda-metrics-apiserver:2.17.0167fd532bd43
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.35.0
1.43.0

Open the chart page →

2,583
kube-prometheus-stacksoftonic81.5.11 of 6See more

kube-prometheus-stack softonic 81.5.1

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.3.2ba93c9d192e5
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

4,974
retail-store-sample-catalog-chartstacksimplifyVerified publisher2.0.01 of 1See more

retail-store-sample-catalog-chart stacksimplify 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-catalog:1.3.0b654b266fa32
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0

Open the chart page →

759
stakefishstakefish0.1.01 of 8See more

stakefish stakefish 0.1.0

1 of the 8 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
prom/prometheus:v2.52.05c435642ca4d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.25.0
1.43.0

Open the chart page →

20,223
ipfsstakewise2.2.01 of 2See more

ipfs stakewise 2.2.0

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0
1.43.0

Open the chart page →

1,239
v3-backendstakewise3.6.01 of 5See more

v3-backend stakewise 3.6.0

1 of the 5 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ipfs/kubo:v0.33.21a30f5ed8579
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.31.0
1.43.0

Open the chart page →

1,239
sn-platform-slimstreamnative1.11.441 of 6See more

sn-platform-slim streamnative 1.11.44

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.43.0f5c29683a301
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.14.0
1.43.0

Open the chart page →

10,134
group-challengesubshell-labVerified publisher2.1.01 of 2See more

group-challenge subshell-lab 2.1.0

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
darthsim/imgproxy:v3.29.17d12c7c8fc66
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.37.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0
1.43.0

Open the chart page →

2,540
agentssynapse0.1.301 of 9See more

agents synapse 0.1.30

1 of the 9 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

7,244
explorersynapse0.2.162 of 6See more

explorer synapse 0.2.16

2 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/explorer:latest00131e3d1eaf
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

8,518
omnirpcsynapse0.2.921 of 2See more

omnirpc synapse 0.2.92

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

1,121
promexportersynapse0.1.11 of 1See more

promexporter synapse 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/promexporter:4a9aad096c2bd1160e56e5472ddac77fa0cde2e9416c1c5aeb86
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.16.0
1.43.0

Open the chart page →

1,704
screenersynapse0.2.51 of 4See more

screener synapse 0.2.5

1 of the 4 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/screener-api:latestb3de2050460a
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

1,091
scribesynapse0.2.162 of 7See more

scribe synapse 0.2.16

2 of the 7 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/omnirpc:latest5217e3d1fc70
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0
ghcr.io/synapsecns/sanguine/scribe:latest81edba952403
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.28.0
1.43.0

Open the chart page →

2,680
sinnersynapse0.1.01 of 6See more

sinner synapse 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/synapsecns/sanguine/sinner:latest3e98a98f6074
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.20.0
1.43.0

Open the chart page →

1,955
act-runnertektonops0.1.21 of 2See more

act-runner tektonops 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
library/docker:23.0.6-dindafa5d5134900
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.14.0
1.43.0

Open the chart page →

4,212
monitoringthl-chartsVerified publisher0.1.11 of 10See more

monitoring thl-charts 0.1.1

1 of the 10 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0

Open the chart page →

18,908
truefoundry-monitoringtruefoundryVerified publisher0.1.61 of 8See more

truefoundry-monitoring truefoundry 0.1.6

1 of the 8 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:12.3.070d9599b186c
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.38.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
0.19.0
1.43.0
1.43.0

Open the chart page →

4,526
eth-validatorwateim1.4.51 of 3See more

eth-validator wateim 1.4.5

1 of the 3 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ethereum/client-go:latest37575ec10fbc
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0

Open the chart page →

4,998
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0

Open the chart page →

969
registrywiremindVerified publisher0.1.11 of 1See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
ghcr.io/distribution/distribution:3.0.04ba3adf47f5c
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.8.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.32.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.32.0
0.19.0
1.43.0
1.43.0

Open the chart page →

1,187
ygdrassil-monitoringygdrassilVerified publisher0.4.02 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-39882.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.33.0
1.43.0

Open the chart page →

9,381

Container images carrying it

274 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
quay.io/argoproj/argo-events:v1.9.10a83d2699ae53
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/argoproj/workflow-controller:v3.7.11c46aa0ded8ed
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.36.0
1.43.0
1
quay.io/cortexproject/cortex:v1.21.18577eb292a01
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/kiali/kiali:v1.89.30dcdb1c1e747
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.22.0
1.43.0
1
quay.io/kiali/kiali:v2.23.07652b1285f50
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.37.0
1.43.0
1
quay.io/opsmxpublic/opa:1.12.084fb1af7401c
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.38.0
1.43.0
1
quay.io/opstree/grafana:12.4.3b61c1ed2f015
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.12.2
0.19.0
1
quay.io/projectquay/clair:4.9.023329c3368e4
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.32.058e117eabcce
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.41.0
1.43.0
1
quay.io/prometheus/alertmanager:v0.31.188b605de9aba
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.39.0
1.43.0
1
quay.io/prometheus/prometheus:v3.0.03b9b2a15d376
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.30.0
1.43.0
1
quay.io/prometheus/prometheus:v2.39.14748e26f9369
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.10.0
1.43.0
1
quay.io/prometheus/prometheus:v2.37.056e7f18e05dd
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.7.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.05888c188cf09
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.5.063805ebb8d2b
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/prometheus/prometheus:v3.2.16927e0919a14
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.34.0
1.43.0
1
quay.io/prometheus/prometheus:v3.4.19abc6cf6aea7
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.35.0
1.43.0
1
quay.io/prometheus/prometheus:v2.34.0b37103e03399
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.4.1
1.43.0
1
quay.io/prometheus/prometheus:v3.11.3c0b857aead0d
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v3.11.2cd37346c9745
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
1.43.0
1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
quay.io/thanos/thanos:v0.40.1aae7b2b030ed
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.36.0
1.43.0
1
quay.io/thanos/thanos:v0.36.1e542959e1b36
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.27.0
1.43.0
1
registry.gitlab.com/xrow-public/ci-tools/tools:main9b9d1ed86b6a
go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp@v0.18.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp@v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.42.0
0.19.0
1.43.0
1.43.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.