CVE-2026-41178
UnscoredAdvisory
Published 24 Jul 2026In the index since 5 Sept 2026
- Severity
- Unscored
- worst across findings
- CVSS
- —
- base score, highest
- EPSS
- 0.003
- 27th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 475
- of 17,787 indexed, latest versions
- Container images
- 438
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel
Carried by container images the latest versions of 475 of 17,787 indexed charts deploy, on 438 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| go.opentelemetry.io/ | v1.41.0, v1.43.0 | 1.42.0 | 438 |
- OSV records
- GO-2026-5158
- Also known as
- GHSA-5wrp-cwcj-q835
Charts affected
475 by stars
Container images carrying it
438 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | f228c7a6b8c5 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | b61c1ed2f015 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 53525d253793 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | bdfee214c7ea | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | a21405ab9a9a | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 1c6818e5e505 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | cb734024b3fd | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 66fe5216c278 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 79f22af49612 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | cbe3e1ea2b6a | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 58e117eabcce | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 1a353def9fe1 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | d0a4e55eeb7f | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 69e9a1b0daf8 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | d66ba9149c22 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 0a0b4c39c1ba | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | b69bed123b02 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 68b92dae8d75 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | bb4e26ff5e2f | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | d3f2b10c4a6d | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 102e66e32218 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | 4f516757aee3 | go.opentelemetry.io/ | 1.42.0 | 1 |
| quay.io/ | b4f33d89ac45 | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.gitlab.com/ | 5b7636dfba3f | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.gitlab.com/ | 9b9d1ed86b6a | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.gitlab.com/ | ed44d81a65de | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.gitlab.com/ | 03015f863a3e | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | 465e72f8b06a | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | cdacfdbe8966 | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | 7ca92c0a7b4f | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | 4d8c68e8c2bf | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | b0d792e0d8df | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | d08f476d04d0 | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | 78adaeb154c7 | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | 190976e2e2fe | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | e354e40db2d0 | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | f9d65db8bda2 | go.opentelemetry.io/ | 1.42.0 | 1 |
| registry.k8s.io/ | 1eb5a85180a4 | go.opentelemetry.io/ | 1.42.0 | 1 |