CVE-2026-54285
MediumAdvisory
Published 15 Jun 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.003
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 56
- of 17,781 indexed, latest versions
- Container images
- 69
- deployed by those charts
- Fix available
- 1 of 1
- affected package
OpenTelemetry Core: Unbounded memory allocation in W3C Baggage propagation
Carried by container images the latest versions of 56 of 17,781 indexed charts deploy, on 69 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| @opentelemetry/ | 0.20.0, 1.9.0, 1.12.0, 1.15.0+15 more | 2.8.0 | 69 |
- OSV records
- GHSA-8988-4f7v-96qf
Charts affected
56 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| retail-store-sample-checkout-chartstacksimplifyVerified publisher | 1.0.0 | 1 of 1See more | 1,313 |
| evolution-apivcnngrVerified publisher | 1.0.0 | 1 of 5See more | 3,746 |
| devportalveecode-platform-nextVerified publisher | 0.1.21 | 1 of 1See more | 1,787 |
| browserlessvictorlane | 0.2.0 | 1 of 1See more | 4,305 |
| wikiwikijs | 3.0.0 | 1 of 2See more | 5,459 |
| kibanawiremindVerified publisher | 8.5.23 | 1 of 2See more | 6,285 |
Container images carrying it
69 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| decisionrules/ | f38d8571fa06 | @opentelemetry/ | 2.8.0 | 4 |
| governify/ | 2987672448c7 | @opentelemetry/ | 2.8.0 | 2 |
| governify/ | 608c6940bb98 | @opentelemetry/ | 2.8.0 | 2 |
| governify/ | d3f37f4f8168 | @opentelemetry/ | 2.8.0 | 2 |
| governify/ | daeca1ce28e6 | @opentelemetry/ | 2.8.0 | 2 |
| governify/ | 38595913458f | @opentelemetry/ | 2.8.0 | 2 |
| infisical/ | 02082bf13163 | @opentelemetry/ | 2.8.0 | 2 |
| requarks/ | 68f0d1848261 | @opentelemetry/ | 2.8.0 | 2 |
| adeptiainc/ | 283001e83739 | @opentelemetry/ | 2.8.0 | 1 |
| adeptiainc/ | 31f295e948e6 | @opentelemetry/ | 2.8.0 | 1 |
| baserow/ | 566d24c7d9f5 | @opentelemetry/ | 2.8.0 | 1 |
| chocobozzz/ | 052712130691 | @opentelemetry/ | 2.8.0 | 1 |
| cortezaproject/ | 4ea78dfe5364 | @opentelemetry/ | 2.8.0 | 1 |
| cryptexlabs/ | 189c07411d7c | @opentelemetry/ | 2.8.0 | 1 |
| directus/ | 9c8470ea465c | @opentelemetry/ | 2.8.0 | 1 |
| diygod/ | 7a6312cac0d5 | @opentelemetry/ | 2.8.0 | 1 |
| docmost/ | 41c8d777cf23 | @opentelemetry/ | 2.8.0 | 1 |
| etherpad/ | b723fe5f2594 | @opentelemetry/ | 2.8.0 | 1 |
| evoapicloud/ | 966625532d90 | @opentelemetry/ | 2.8.0 | 1 |
| fonoster/ | e8c84b5eaa67 | @opentelemetry/ | 2.8.0 | 1 |
| fonoster/ | 5f8f380dc174 | @opentelemetry/ | 2.8.0 | 1 |
| fonoster/ | 051ba9c34ef5 | @opentelemetry/ | 2.8.0 | 1 |
| fonoster/ | e4d5f5ff1945 | @opentelemetry/ | 2.8.0 | 1 |
| fonoster/ | e27001f2813c | @opentelemetry/ | 2.8.0 | 1 |
| governify/ | 6d3d1a5b46a9 | @opentelemetry/ | 2.8.0 | 1 |
| journeyapps/ | bf46f66e5dcc | @opentelemetry/ | 2.8.0 | 1 |
| library/ | 1ef2e532ca4d | @opentelemetry/ | 2.8.0 | 1 |
| library/ | 2654b1e90413 | @opentelemetry/ | 2.8.0 | 1 |
| library/ | 29773d6be407 | @opentelemetry/ | 2.8.0 | 1 |
| library/ | 77196da4b0df | @opentelemetry/ | 2.8.0 | 1 |
| library/ | ac533a6988ee | @opentelemetry/ | 2.8.0 | 1 |
| library/ | 0172f1c538e7 | @opentelemetry/ | 2.8.0 | 1 |
| library/ | 04c0fc150f3a | @opentelemetry/ | 2.8.0 | 1 |
| n8nio/ | 761374d4eb84 | @opentelemetry/ | 2.8.0 | 1 |
| n8nio/ | 8b39ed5a2de9 | @opentelemetry/ | 2.8.0 | 1 |
| nocodb/ | 4b760f0d2547 | @opentelemetry/ | 2.8.0 | 1 |
| nocodb/ | d9516f0bf546 | @opentelemetry/ | 2.8.0 | 1 |
| outlinewiki/ | 494dfb9249a6 | @opentelemetry/ | 2.8.0 | 1 |
| rahulbhiwagade122/ | 08490b70998c | @opentelemetry/ | 2.8.0 | 1 |
| rocketadmin/ | 10955ef540b9 | @opentelemetry/ | 2.8.0 | 1 |
| rocketchat/ | 44af8ac4e711 | @opentelemetry/ | 2.8.0 | 1 |
| rocketchat/ | 6bc18fb5d0e5 | @opentelemetry/ | 2.8.0 | 1 |
| rocketchat/ | 819771c4abe4 | @opentelemetry/ | 2.8.0 | 1 |
| rocketchat/ | c1170bdfe797 | @opentelemetry/ | 2.8.0 | 1 |
| speckle/ | 75cdf256067b | @opentelemetry/ | 2.8.0 | 1 |
| speckle/ | 79f14a2bf931 | @opentelemetry/ | 2.8.0 | 1 |
| speckle/ | 8fd157733393 | @opentelemetry/ | 2.8.0 | 1 |
| supabase/ | a84cc713585e | @opentelemetry/ | 2.8.0 | 1 |
| supabase/ | c8eb9858eafe | @opentelemetry/ | 2.8.0 | 1 |
| supabase/ | f983fb50bd95 | @opentelemetry/ | 2.8.0 | 1 |