CVE-2026-41178
UnscoredAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.003
- 27th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 475
- of 17,787 indexed, latest versions
- Container images
- 438
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel
Carried by container images the latest versions of 475 of 17,787 indexed charts deploy, on 438 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.41.0, v1.43.0 | 1.42.0 | 438 |
- OSV records
- GO-2026-5158
- Also known as
- GHSA-5wrp-cwcj-q835
Charts affected
475 by stars
Container images carrying it
438 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| ghcr.io/ | aab0c99d313f | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 73689c430946 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | e45a5fcdf1a4 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 3af8698e0524 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 6aceb380776c | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 8b41a7c5f1bf | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 05765ee83074 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | aeab520e775b | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 9cf36d15744d | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | a96853470256 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 511231955463 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | fdfffa3984a5 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 8637f0482ed1 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 0f651dd95507 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | 52a0f1ed0c03 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | d92eda891c91 | go.opentelemetry.io/ | 1.42.0 | 1 |
| ghcr.io/ | a7a846bba3e8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| mcr.microsoft.com/ | 8b3ce8339944 | go.opentelemetry.io/ | 1.42.0 | 1 |
| mcr.microsoft.com/ | cb0112636dc4 | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | f1348a65664a | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | ee9d973e3952 | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | af8cea3b8538 | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | 70f191d0a80e | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | adc2f5d5996b | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | f30f0dc32205 | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | bbba62c5a110 | go.opentelemetry.io/ | 1.42.0 | 1 |
| public.ecr.aws/ | 4e25d84332fc | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 3c56f354fac5 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | a09814522a72 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 0d03a6aad575 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | f8f4e990bc9f | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 0885ab519dac | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | d3ccf28495c3 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | b58b6d40c3bb | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 2804aabd76d2 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | b26660528928 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | ad1dcc5b2fcc | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | e370f7800a53 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 8bd9cdb714a6 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 68b3c5029dc6 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | c33cca307541 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 5bb3ad7621c8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 4a779237ef1c | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 2044ed750f5e | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 01b2694425e9 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 01f2b053ace1 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 68657c36c086 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | b5f5bd4efbee | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 9888240f644b | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | ea08b5e5f4ab | go.opentelemetry.io/ | 1.42.0 | 1 |