CVE-2026-39882
MediumAdvisory
Published 8 Apr 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.002
- 9th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 286
- of 17,781 indexed, latest versions
- Container images
- 274
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies
Carried by container images the latest versions of 286 of 17,781 indexed charts deploy, on 274 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.0.0, v1.3.0, v1.4.1, v1.6.3+35 more | 1.43.0 | 253 |
| go.opentelemetry.io/ | v0.31.0, v0.36.0, v0.39.0, v0.40.0+23 more | 1.43.0 | 123 |
| go.opentelemetry.io/ | v0.4.0, v0.5.0, v0.6.0, v0.7.0+10 more | 0.19.0 | 66 |
- OSV records
- GHSA-w8rr-5gcm-pp58
- Also known as
- GO-2026-4985
Charts affected
286 by stars
Container images carrying it
274 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| wurstmeister/ | 2d4bbf9cc83d | go.opentelemetry.io/ | 1.43.0 | 7 |
| quay.io/ | 4ec6df40fdb9 | go.opentelemetry.io/ | 1.43.0 | 7 |
| grafana/ | 3c8fd3570dd9 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 4 |
| grafana/ | 65a578975943 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 4 |
| ghcr.io/ | 5217e3d1fc70 | go.opentelemetry.io/ | 1.43.0 | 4 |
| grafana/ | 0dac7d5cb383 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 3 |
| library/ | af96c680a7e1 | go.opentelemetry.io/ | 1.43.0 | 3 |
| oryd/ | 2c93beb5e5f2 | go.opentelemetry.io/ | 1.43.0 | 3 |
| prom/ | 565ee8650122 | go.opentelemetry.io/ | 1.43.0 | 3 |
| quay.io/ | d30a7c640c63 | go.opentelemetry.io/ | 1.43.0 | 3 |
| quay.io/ | 1a3e9a878e50 | go.opentelemetry.io/ | 1.43.0 | 3 |
| quay.io/ | 378f4e037035 | go.opentelemetry.io/ | 1.43.0 | 3 |
| quay.io/ | 7571a304e67f | go.opentelemetry.io/ | 1.43.0 | 3 |
| quay.io/ | f5c29683a301 | go.opentelemetry.io/ | 1.43.0 | 3 |
| devopsfaith/ | f8bdaa8a1a43 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 2 |
| grafana/ | 7790f6f7fbd8 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 2 |
| grafana/ | f94b1c82957a | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 2 |
| grafana/ | 2175aaa91c96 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 2 |
| grafana/ | 9e1e77ade304 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 2 |
| grafana/ | e932bd6ed0e0 | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 2 |
| grafana/ | f0200a9bff6d | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 2 |
| ipfs/ | 1a30f5ed8579 | go.opentelemetry.io/ | 1.43.0 | 2 |
| oryd/ | d06fc5845f63 | go.opentelemetry.io/ | 1.43.0 | 2 |
| oryd/ | fe2428f103a6 | go.opentelemetry.io/ | 1.43.0 | 2 |
| oryd/ | e8cb9b79a89c | go.opentelemetry.io/ | 1.43.0 | 2 |
| otel/ | 7ef2a2ff46b9 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 2 |
| otel/ | 32b3c8296dcc | go.opentelemetry.io/ go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 1.43.0 | 2 |
| prom/ | 5c435642ca4d | go.opentelemetry.io/ | 1.43.0 | 2 |
| prom/ | 8176adea328e | go.opentelemetry.io/ | 1.43.0 | 2 |
| prom/ | a67e5e402ff5 | go.opentelemetry.io/ | 1.43.0 | 2 |
| rancher/ | 9380f5dbae9a | go.opentelemetry.io/ | 1.43.0 | 2 |
| thanosio/ | cf3e9b292e43 | go.opentelemetry.io/ | 1.43.0 | 2 |
| uselagoon/ | 2c89ed939b8b | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 2 |
| zhenghaoz/ | 033046b432ec | go.opentelemetry.io/ | 1.43.0 | 2 |
| zhenghaoz/ | 39c565685b01 | go.opentelemetry.io/ | 1.43.0 | 2 |
| zhenghaoz/ | f7739f64c9b0 | go.opentelemetry.io/ | 1.43.0 | 2 |
| ghcr.io/ | 2659f4c2ebb7 | go.opentelemetry.io/ | 1.43.0 | 2 |
| ghcr.io/ | 4768ea1c5fd2 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 2 |
| ghcr.io/ | e70364e88629 | go.opentelemetry.io/ go.opentelemetry.io/ | 0.19.0 1.43.0 | 2 |
| ghcr.io/ | b940cab56435 | go.opentelemetry.io/ | 1.43.0 | 2 |
| ghcr.io/ | 0d1df8f436f7 | go.opentelemetry.io/ | 1.43.0 | 2 |
| public.ecr.aws/ | 0dfb323978f6 | go.opentelemetry.io/ | 1.43.0 | 2 |
| quay.io/ | fa07b2c9ece6 | go.opentelemetry.io/ | 1.43.0 | 2 |
| quay.io/ | 075b1ba2c4eb | go.opentelemetry.io/ | 1.43.0 | 2 |
| quay.io/ | 6559acbd5d77 | go.opentelemetry.io/ | 1.43.0 | 2 |
| quay.io/ | c5dd35038287 | go.opentelemetry.io/ | 1.43.0 | 2 |
| quay.io/ | df0cd5887887 | go.opentelemetry.io/ | 1.43.0 | 2 |
| quay.io/ | f6639335d34a | go.opentelemetry.io/ | 1.43.0 | 2 |
| quay.io/ | 1d022ef4b8ef | go.opentelemetry.io/ | 1.43.0 | 2 |
| 1dev/ | cd5b12fe5471 | go.opentelemetry.io/ go.opentelemetry.io/ | 1.43.0 1.43.0 | 1 |