CVE-2026-41178
UnscoredAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.003
- 27th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 475
- of 17,787 indexed, latest versions
- Container images
- 438
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel
Carried by container images the latest versions of 475 of 17,787 indexed charts deploy, on 438 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.41.0, v1.43.0 | 1.42.0 | 438 |
- OSV records
- GO-2026-5158
- Also known as
- GHSA-5wrp-cwcj-q835
Charts affected
475 by stars
Container images carrying it
438 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| alpine/ | b421c2e9419e | go.opentelemetry.io/ | 1.42.0 | 1 |
| alpine/ | b7a12c5ddf26 | go.opentelemetry.io/ | 1.42.0 | 1 |
| alpine/ | d870622d0040 | go.opentelemetry.io/ | 1.42.0 | 1 |
| alpine/ | 1ee9df6316d4 | go.opentelemetry.io/ | 1.42.0 | 1 |
| altinity/ | 0520bfb8015d | go.opentelemetry.io/ | 1.42.0 | 1 |
| altinity/ | a802b3a19d20 | go.opentelemetry.io/ | 1.42.0 | 1 |
| altinity/ | 1e7c1d8167aa | go.opentelemetry.io/ | 1.42.0 | 1 |
| altinity/ | 8940ecadae65 | go.opentelemetry.io/ | 1.42.0 | 1 |
| amazon/ | 9dea6643715a | go.opentelemetry.io/ | 1.42.0 | 1 |
| apache/ | 96832082e9cf | go.opentelemetry.io/ | 1.42.0 | 1 |
| apache/ | fe8f5ec91f6c | go.opentelemetry.io/ | 1.42.0 | 1 |
| aquasec/ | e0b1c7ddc843 | go.opentelemetry.io/ | 1.42.0 | 1 |
| bitnami/ | b7e25b5c57d9 | go.opentelemetry.io/ | 1.42.0 | 1 |
| bitnami/ | f7034c13af4e | go.opentelemetry.io/ | 1.42.0 | 1 |
| checkmk/ | c11b422210c4 | go.opentelemetry.io/ | 1.42.0 | 1 |
| clastix/ | a7c5d108810b | go.opentelemetry.io/ | 1.42.0 | 1 |
| concourse/ | 40a143ce5873 | go.opentelemetry.io/ | 1.42.0 | 1 |
| coredns/ | 900f9c109f7a | go.opentelemetry.io/ | 1.42.0 | 1 |
| devsecurely/ | eecd4314e933 | go.opentelemetry.io/ | 1.42.0 | 1 |
| distribution/ | bca24727f400 | go.opentelemetry.io/ | 1.42.0 | 1 |
| dunglas/ | 80fcb704a741 | go.opentelemetry.io/ | 1.42.0 | 1 |
| eginnovations/ | e4dfe242fe9f | go.opentelemetry.io/ | 1.42.0 | 1 |
| elastiflow/ | fee67842e16b | go.opentelemetry.io/ | 1.42.0 | 1 |
| epamedp/ | a5398eaa7b80 | go.opentelemetry.io/ | 1.42.0 | 1 |
| epamedp/ | 9fede333ef27 | go.opentelemetry.io/ | 1.42.0 | 1 |
| epamedp/ | 661d1648a49a | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethereum/ | 37575ec10fbc | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethereum/ | b8ab3451a117 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethersphere/ | e4cda693ed63 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethpandaops/ | 1efa2fba6711 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethpandaops/ | 9dc0b50e6c27 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethpandaops/ | 1edd4074fd79 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethpandaops/ | 5c4832e9588f | go.opentelemetry.io/ | 1.42.0 | 1 |
| ethpandaops/ | 5f731b20ec50 | go.opentelemetry.io/ | 1.42.0 | 1 |
| falcosecurity/ | 932956d86c99 | go.opentelemetry.io/ | 1.42.0 | 1 |
| falcosecurity/ | d0cfe422d6ac | go.opentelemetry.io/ | 1.42.0 | 1 |
| falcosecurity/ | 0eeb79adc580 | go.opentelemetry.io/ | 1.42.0 | 1 |
| falcosecurity/ | 7df783d5269a | go.opentelemetry.io/ | 1.42.0 | 1 |
| falcosecurity/ | 8a99fcc57a57 | go.opentelemetry.io/ | 1.42.0 | 1 |
| flashcatcloud/ | 42e6ab16472e | go.opentelemetry.io/ | 1.42.0 | 1 |
| fluxcd/ | 704d55295355 | go.opentelemetry.io/ | 1.42.0 | 1 |
| fosrl/ | ccd2b0e9a049 | go.opentelemetry.io/ | 1.42.0 | 1 |
| garethgeorge/ | b85297975428 | go.opentelemetry.io/ | 1.42.0 | 1 |
| getconvoy/ | f4934cc05e31 | go.opentelemetry.io/ | 1.42.0 | 1 |
| gomods/ | 0f61d1e62359 | go.opentelemetry.io/ | 1.42.0 | 1 |
| gomods/ | 97cc113b34b0 | go.opentelemetry.io/ | 1.42.0 | 1 |
| grafana/ | 84b76d56c594 | go.opentelemetry.io/ | 1.42.0 | 1 |
| grafana/ | eeb2cfecb23e | go.opentelemetry.io/ | 1.42.0 | 1 |
| grafana/ | 2d1f9ae67c17 | go.opentelemetry.io/ | 1.42.0 | 1 |
| grafana/ | ab5cb380e3ff | go.opentelemetry.io/ | 1.42.0 | 1 |