CVE-2026-48504
MediumAdvisory
Published 25 Jun 2026In the index since 8 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.004
- 35th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 4
- of 17,781 indexed, latest versions
- Container images
- 13
- deployed by those charts
- Fix available
- 1 of 1
- affected package
opentelemetry_sdk has unbounded memory allocation in W3C Baggage propagation
Carried by container images the latest versions of 4 of 17,781 indexed charts deploy, on 13 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| opentelemetry_sdkcargo | 0.26.0, 0.27.1 | 0.32.1 | 13 |
- OSV records
- GHSA-w9wp-h8wv-79jx
Charts affected
4 by stars
Container images carrying it
13 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| openebs/ | 6c4d5a9b445b | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | e00ff76f8fc5 | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | 547f60e1667f | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | 2579357ed812 | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | 97b21a6229f1 | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | 483219d1bdc6 | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | e7cb929c2c1d | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | ff563da470cd | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | b9e01affcd07 | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | 1ee2f440bea7 | opentelemetry_sdk | 0.32.1 | 2 |
| openebs/ | 19739f0ed727 | opentelemetry_sdk | 0.32.1 | 2 |
| ghcr.io/ | 834ea54370f0 | opentelemetry_sdk | 0.32.1 | 1 |
| ghcr.io/ | 558cb7e2604d | opentelemetry_sdk | 0.32.1 | 1 |