StackRadar

CVE-2026-40894

Medium

Advisory

Published 23 Apr 2026In the index since 8 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.005
38th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
42
of 17,781 indexed, latest versions
Container images
42
deployed by those charts
Fix available
2 of 2
affected packages

OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers

Carried by container images the latest versions of 42 of 17,781 indexed charts deploy, on 42 images.

Affected packageAffected versionsFixed inImages
OpenTelemetry.Apinuget1.3.1, 1.9.0, 1.10.0, 1.12.0+1 more1.15.342
OpenTelemetry.Extensions.Propagatorsnuget1.3.1, 1.9.0, 1.14.01.15.34
OSV records
GHSA-g94r-2vxg-569j

Charts affected

42 by stars
ChartLatestAffected imagesRadar Score
aramid-participationbiatec-repoVerified publisher4.4.11 of 1See more

aramid-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-aramidmain-extended:4.4.1-stablef12ce1cfb72e
OpenTelemetry.Api@1.9.0
1.15.3

Open the chart page →

7,190
voimain-participationbiatec-repoVerified publisher4.4.11 of 1See more

voimain-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
OpenTelemetry.Api@1.9.0
1.15.3

Open the chart page →

7,190
algorand-participationbiatec-repoVerified publisher4.4.11 of 1See more

algorand-participation biatec-repo 4.4.1

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
scholtz2/algorand-participation-mainnet-extended:4.4.1-stable5aaa5d4ab8b8
OpenTelemetry.Api@1.9.0
1.15.3

Open the chart page →

7,190
magnifhirchglVerified publisher1.3.721 of 1See more

magnifhir chgl 1.3.72

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
ghcr.io/chgl/magnifhir:v1.5.213f121613edd
OpenTelemetry.Api@1.9.0
1.15.3

Open the chart page →

1,142
ms-catalogs-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-catalogs-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-catalogs-rest:latest03b80bec4458
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-emails-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-emails-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-emails-grpc:lateste336012bc781
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

9,367
ms-emails-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-emails-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-emails-rest:latestac84661c605e
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

9,367
ms-emails-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-emails-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-emails-worker:latest48fe7e6ceaba
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

247
ms-filestorage-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-filestorage-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-filestorage-rest:latest7666ccfa0d68
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-licenses-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-licenses-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-licenses-grpc:latest360144457f4d
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

1,136
ms-licenses-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-licenses-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-licenses-rest:latest52963715c729
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-licenses-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-licenses-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-licenses-worker:latest2c302fb759dc
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-locations-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-locations-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-locations-grpc:latest26855ebf033b
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-locations-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-locations-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-locations-rest:latestb8d4447931f4
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-microsoftgraph-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-microsoftgraph-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-microsoftgraph-rest:latestc314db2706e5
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

247
ms-microsoftgraph-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-microsoftgraph-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-microsoftgraph-worker:latestc3568b61d762
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

247
ms-modules-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-modules-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-modules-grpc:latest3f6aaa32d526
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

1,136
ms-modules-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-modules-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-modules-rest:latest091de71a83df
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-notification-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-notification-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-notification-grpc:latestc7525541cb5f
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

356
ms-notification-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-notification-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-notification-rest:lateste46e7e36b8e0
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

87
ms-payments-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-payments-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-payments-grpc:latest88ea9bbcb04c
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-payments-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-payments-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-payments-rest:latest6a3591b82a40
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-payments-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-payments-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-payments-worker:latest50171f042666
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-rbac-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-rbac-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-rbac-grpc:latest85bee1edfe2a
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-rbac-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-rbac-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-rbac-rest:latesta156d021775d
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-roles-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-roles-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-roles-rest:latestc364711341a0
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-services-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-services-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-services-grpc:latest1462eb1101db
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-services-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-services-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-services-rest:lateste0f8ef13842f
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-tenants-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-tenants-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-tenants-grpc:latesta33d3361e60c
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-tenants-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-tenants-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-tenants-rest:latest5762fc421070
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-tenants-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-tenants-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-tenants-worker:latestf476a3084860
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-users-grpccodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-users-grpc codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-users-grpc:latest2cff841dd824
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-users-restcodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-users-rest codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-users-rest:lateste9c7ab8d91ef
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
ms-users-workercodedesignplus-chartsVerified publisher0.0.241 of 1See more

ms-users-worker codedesignplus-charts 0.0.24

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
codedesignplus/ms-users-worker:latest94094b21a2c5
OpenTelemetry.Api@1.12.0
1.15.3

Open the chart page →

235
opentelemetry-demogpg-dev0.33.81 of 27See more

opentelemetry-demo gpg-dev 0.33.8

1 of the 27 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:1.12.0-accountingservice6d051840bb29
OpenTelemetry.Api@1.9.0
OpenTelemetry.Extensions.Propagators@1.9.0
1.15.3
1.15.3

Open the chart page →

49,025
zileank8s-home-lab-repo1.0.11 of 1See more

zilean k8s-home-lab-repo 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
ghcr.io/thoroslives/zilean:v3.10.1bce6aca0f6ca
OpenTelemetry.Api@1.10.0
1.15.3

Open the chart page →

2,025
middleware-odigosmiddleware-labsVerified publisher0.2.411 of 6See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
OpenTelemetry.Api@1.3.1
OpenTelemetry.Extensions.Propagators@1.3.1
1.15.3
1.15.3

Open the chart page →

8,370
middleware-visionmiddleware-labsVerified publisher0.2.651 of 6See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
OpenTelemetry.Api@1.3.1
OpenTelemetry.Extensions.Propagators@1.3.1
1.15.3
1.15.3

Open the chart page →

8,361
helmmirasys-chart0.1.01 of 4See more

helm mirasys-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
sepehrmdn/mirasys-assignment:1.0.12567228e33c8
OpenTelemetry.Api@1.9.0
1.15.3

Open the chart page →

4,292
serviceexampleserviceexample-chart0.3.01 of 4See more

serviceexample serviceexample-chart 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
tibyandocker/serviceexample:latesta4ad592cea84
OpenTelemetry.Api@1.9.0
1.15.3

Open the chart page →

3,928
service-exampleservice-example-jt0.1.11 of 9See more

service-example service-example-jt 0.1.1

1 of the 9 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
janzo83/serviceexample:latestfb3c4ac36f3e
OpenTelemetry.Api@1.9.0
1.15.3

Open the chart page →

7,157
fdi-dotstatsuitestatcan0.3.51 of 3See more

fdi-dotstatsuite statcan 0.3.5

1 of the 3 container images this version deploys carry CVE-2026-40894.

Container imageDigestPackageFixed in
siscc/sdmxri-nsi-maapi:master6cf1145566f0
OpenTelemetry.Api@1.14.0
OpenTelemetry.Extensions.Propagators@1.14.0
1.15.3
1.15.3

Open the chart page →

511

Container images carrying it

42 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
codedesignplus/ms-catalogs-rest:latest03b80bec4458
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-emails-grpc:lateste336012bc781
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-emails-rest:latestac84661c605e
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-emails-worker:latest48fe7e6ceaba
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-filestorage-rest:latest7666ccfa0d68
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-licenses-grpc:latest360144457f4d
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-licenses-rest:latest52963715c729
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-licenses-worker:latest2c302fb759dc
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-locations-grpc:latest26855ebf033b
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-locations-rest:latestb8d4447931f4
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-microsoftgraph-rest:latestc314db2706e5
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-microsoftgraph-worker:latestc3568b61d762
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-modules-grpc:latest3f6aaa32d526
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-modules-rest:latest091de71a83df
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-notification-grpc:latestc7525541cb5f
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-notification-rest:lateste46e7e36b8e0
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-payments-grpc:latest88ea9bbcb04c
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-payments-rest:latest6a3591b82a40
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-payments-worker:latest50171f042666
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-rbac-grpc:latest85bee1edfe2a
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-rbac-rest:latesta156d021775d
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-roles-rest:latestc364711341a0
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-services-grpc:latest1462eb1101db
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-services-rest:lateste0f8ef13842f
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-tenants-grpc:latesta33d3361e60c
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-tenants-rest:latest5762fc421070
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-tenants-worker:latestf476a3084860
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-users-grpc:latest2cff841dd824
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-users-rest:lateste9c7ab8d91ef
OpenTelemetry.Api@1.12.0
1.15.3
1
codedesignplus/ms-users-worker:latest94094b21a2c5
OpenTelemetry.Api@1.12.0
1.15.3
1
janzo83/serviceexample:latestfb3c4ac36f3e
OpenTelemetry.Api@1.9.0
1.15.3
1
scholtz2/algorand-participation-aramidmain-extended:4.4.1-stablef12ce1cfb72e
OpenTelemetry.Api@1.9.0
1.15.3
1
scholtz2/algorand-participation-mainnet-extended:4.4.1-stable5aaa5d4ab8b8
OpenTelemetry.Api@1.9.0
1.15.3
1
scholtz2/algorand-participation-voimain-extended:4.4.1-stable64966de56d9f
OpenTelemetry.Api@1.9.0
1.15.3
1
sepehrmdn/mirasys-assignment:1.0.12567228e33c8
OpenTelemetry.Api@1.9.0
1.15.3
1
siscc/sdmxri-nsi-maapi:master6cf1145566f0
OpenTelemetry.Api@1.14.0
OpenTelemetry.Extensions.Propagators@1.14.0
1.15.3
1.15.3
1
tibyandocker/serviceexample:latesta4ad592cea84
OpenTelemetry.Api@1.9.0
1.15.3
1
ghcr.io/chgl/magnifhir:v1.5.213f121613edd
OpenTelemetry.Api@1.9.0
1.15.3
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
OpenTelemetry.Api@1.3.1
OpenTelemetry.Extensions.Propagators@1.3.1
1.15.3
1.15.3
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
OpenTelemetry.Api@1.3.1
OpenTelemetry.Extensions.Propagators@1.3.1
1.15.3
1.15.3
1
ghcr.io/open-telemetry/demo:1.12.0-accountingservice6d051840bb29
OpenTelemetry.Api@1.9.0
OpenTelemetry.Extensions.Propagators@1.9.0
1.15.3
1.15.3
1
ghcr.io/thoroslives/zilean:v3.10.1bce6aca0f6ca
OpenTelemetry.Api@1.10.0
1.15.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.