CVE-2026-59892

High

Advisory

Published 21 Jul 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.008; 54th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 28; of 17,781 indexed, latest versions
Container images: 36; deployed by those charts
Fix available: 1 of 1; affected package

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Carried by container images the latest versions of 28 of 17,781 indexed charts deploy, on 36 images.

Affected package	Affected versions	Fixed in	Images
@opentelemetry/propagator-jaegernpm	1.8.0, 1.12.0, 1.24.1, 1.25.1+8 more	2.9.0	36

OSV records: GHSA-45rx-2jwx-cxfr

Charts affected

28 by stars

Chart

Latest

Affected images

Radar Score

rocketchatrocketchat-server

7.0.2

4 of 12 See more

rocketchat rocketchat-server 7.0.2

4 of the 12 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
rocketchat/account-service :8.6.1	44af8ac4e711	@opentelemetry/propagator-jaeger@2.7.1	2.9.0
rocketchat/authorization-service :8.6.1	6bc18fb5d0e5	@opentelemetry/propagator-jaeger@2.7.1	2.9.0
rocketchat/ddp-streamer-service :8.6.1	819771c4abe4	@opentelemetry/propagator-jaeger@2.7.1	2.9.0
rocketchat/presence-service :8.6.1	c1170bdfe797	@opentelemetry/propagator-jaeger@2.7.1	2.9.0

Open the chart page →

12,279

openclawopenclaw-helm

1.5.40

1 of 2 See more

openclaw openclaw-helm 1.5.40

1 of the 2 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	@opentelemetry/propagator-jaeger@2.7.1	2.9.0

Open the chart page →

5,660

supabasetokens-studio

1.0.0

1 of 14 See more

supabase tokens-studio 1.0.0

1 of the 14 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
supabase/storage-api :v1.12.0	f983fb50bd95	@opentelemetry/propagator-jaeger@1.26.0	2.9.0

Open the chart page →

23,123

openclaw-with-brainopenclaw-with-brain

0.1.67

1 of 3 See more

openclaw-with-brain openclaw-with-brain 0.1.67

1 of the 3 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/openclaw/openclaw :2026.6.10	af7ea052cf21	@opentelemetry/propagator-jaeger@2.8.0	2.9.0

Open the chart page →

5,218

immichimmich-helm

0.3.0

1 of 4 See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	@opentelemetry/propagator-jaeger@2.2.0	2.9.0

Open the chart page →

15,712

n8nn8n-helm

2.25.7

1 of 1 See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
n8nio/n8n :2.25.7	761374d4eb84	@opentelemetry/propagator-jaeger@2.7.1	2.9.0

Open the chart page →

2,575

portraitportrait

0.2.13

1 of 8 See more

portrait portrait 0.2.13

1 of the 8 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
treskon/portrait-ui :DEV-latest	e7970783bc8d	@opentelemetry/propagator-jaeger@1.12.0	2.9.0

Open the chart page →

31,844

speckle-serverspeckle

2.26.3

1 of 4 See more

speckle-server speckle 2.26.3

1 of the 4 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.26.3	79f14a2bf931	@opentelemetry/propagator-jaeger@1.26.0	2.9.0

Open the chart page →

10,380

supabasesupabse

0.8.0

1 of 11 See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
supabase/storage-api :v1.60.4	c8eb9858eafe	@opentelemetry/propagator-jaeger@2.0.1	2.9.0

Open the chart page →

18,075

tenuretenure

1.0.6

1 of 2 See more

tenure tenure 1.0.6

1 of the 2 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
tenureai/tenure :v1.0.28	5f5b222df9a5	@opentelemetry/propagator-jaeger@2.8.0	2.9.0

Open the chart page →

2,522

trifidzazuko

0.2.1

1 of 1 See more

trifid zazuko 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/zazuko/trifid :v6.0.1	59bda2bf65d4	@opentelemetry/propagator-jaeger@2.8.0	2.9.0

Open the chart page →

338

adeptia-automate-mcpadeptia-automate-mcp

1.0.0

2 of 2 See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	@opentelemetry/propagator-jaeger@1.30.1	2.9.0
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	@opentelemetry/propagator-jaeger@2.6.0	2.9.0

Open the chart page →

3,600

cloudpremcloudprem

0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of 6 See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

3 of the 6 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	@opentelemetry/propagator-jaeger@1.28.0	2.9.0
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	@opentelemetry/propagator-jaeger@1.26.0	2.9.0
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	@opentelemetry/propagator-jaeger@1.26.0	2.9.0

Open the chart page →

18,293

authfcryptexlabs

0.12.13

1 of 4 See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
cryptexlabs/authf :0.12.11	189c07411d7c	@opentelemetry/propagator-jaeger@1.26.0	2.9.0

Open the chart page →

3,769

decisionrules-aksdecisionrules-aks

0.2.0

1 of 2 See more

decisionrules-aks decisionrules-aks 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
decisionrules/server :latest	f38d8571fa06	@opentelemetry/propagator-jaeger@2.7.1	2.9.0

Open the chart page →

1,138

decisionrules-eksdecisionrules-eks

0.3.0

1 of 2 See more

decisionrules-eks decisionrules-eks 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
decisionrules/server :latest	f38d8571fa06	@opentelemetry/propagator-jaeger@2.7.1	2.9.0

Open the chart page →

1,138

decisionrules-ingressdecisionrules-ingress

0.2.0

1 of 2 See more

decisionrules-ingress decisionrules-ingress 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
decisionrules/server :latest	f38d8571fa06	@opentelemetry/propagator-jaeger@2.7.1	2.9.0

Open the chart page →

1,138

decisionrules-ocpdecisionrules-ocp

0.1.0

1 of 4 See more

decisionrules-ocp decisionrules-ocp 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
decisionrules/server :latest	f38d8571fa06	@opentelemetry/propagator-jaeger@2.7.1	2.9.0

Open the chart page →

2,685

desishowbiz-frontenddesishowbiz

1.0.0

1 of 1 See more

desishowbiz-frontend desishowbiz 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
rahulbhiwagade122/desishowbiz :latest	08490b70998c	@opentelemetry/propagator-jaeger@1.30.1	2.9.0

Open the chart page →

2,529

opentelemetry-demogpg-dev

0.33.8

2 of 27 See more

opentelemetry-demo gpg-dev 0.33.8

2 of the 27 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/open-telemetry/demo :1.12.0-frontend	8b348f00ca4c	@opentelemetry/propagator-jaeger@1.25.1	2.9.0
ghcr.io/open-telemetry/demo :1.12.0-paymentservice	b0f13eef3abf	@opentelemetry/propagator-jaeger@1.24.1	2.9.0

Open the chart page →

49,025

bluesky-pdsijmacd

1.0.0

1 of 2 See more

bluesky-pds ijmacd 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/bluesky-social/pds :0.4	d95725b24dbe	@opentelemetry/propagator-jaeger@2.8.0	2.9.0

Open the chart page →

8,967

middleware-odigosmiddleware-labs

0.2.41

1 of 6 See more

middleware-odigos middleware-labs 0.2.41

1 of the 6 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/odigos-odiglet :middleware-test-0.0.1	03c8c835ecee	@opentelemetry/propagator-jaeger@1.8.0	2.9.0

Open the chart page →

8,370

middleware-visionmiddleware-labs

0.2.65

1 of 6 See more

middleware-vision middleware-labs 0.2.65

1 of the 6 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
ghcr.io/middleware-labs/vision-odiglet :middleware-test-0.0.3	bce34c98668e	@opentelemetry/propagator-jaeger@1.8.0	2.9.0

Open the chart page →

8,361

routr-connectroutr

0.4.3

5 of 10 See more

routr-connect routr 0.4.3

5 of the 10 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
fonoster/routr-connect :2.13.6	e8c84b5eaa67	@opentelemetry/propagator-jaeger@1.26.0	2.9.0
fonoster/routr-dispatcher :2.13.6	5f8f380dc174	@opentelemetry/propagator-jaeger@1.26.0	2.9.0
fonoster/routr-location :2.13.6	051ba9c34ef5	@opentelemetry/propagator-jaeger@1.26.0	2.9.0
fonoster/routr-pgdata :2.13.6	e4d5f5ff1945	@opentelemetry/propagator-jaeger@1.26.0	2.9.0
fonoster/routr-registry :2.13.6	e27001f2813c	@opentelemetry/propagator-jaeger@1.26.0	2.9.0

Open the chart page →

11,021

speckle-server-branch-testing5speckle

2.21.3-branch.testing5.219631-2153bef

1 of 5 See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	@opentelemetry/propagator-jaeger@1.26.0	2.9.0

Open the chart page →

15,635

speckle-server-branch-testing6speckle

2.25.10-branch.testing6.645-b125c1e

1 of 4 See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	@opentelemetry/propagator-jaeger@1.26.0	2.9.0

Open the chart page →

11,100

retail-store-sample-checkout-chartstacksimplify

1.0.0

1 of 1 See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	@opentelemetry/propagator-jaeger@2.0.1	2.9.0

Open the chart page →

1,313

supabaseteochenglim

0.1.2

1 of 13 See more

supabase teochenglim 0.1.2

1 of the 13 container images this version deploys carry CVE-2026-59892.

Container image	Digest	Package	Fixed in
supabase/storage-api :latest	f6c42a04163d	@opentelemetry/propagator-jaeger@2.8.0	2.9.0

Open the chart page →

9,556

Container images carrying it

36 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
decisionrules/server :latest	f38d8571fa06	@opentelemetry/propagator-jaeger@2.7.1	2.9.0	4
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	@opentelemetry/propagator-jaeger@1.30.1	2.9.0	1
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	@opentelemetry/propagator-jaeger@2.6.0	2.9.0	1
cryptexlabs/authf :0.12.11	189c07411d7c	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
fonoster/routr-connect :2.13.6	e8c84b5eaa67	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
fonoster/routr-dispatcher :2.13.6	5f8f380dc174	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
fonoster/routr-location :2.13.6	051ba9c34ef5	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
fonoster/routr-pgdata :2.13.6	e4d5f5ff1945	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
fonoster/routr-registry :2.13.6	e27001f2813c	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
n8nio/n8n :2.25.7	761374d4eb84	@opentelemetry/propagator-jaeger@2.7.1	2.9.0	1
rahulbhiwagade122/desishowbiz :latest	08490b70998c	@opentelemetry/propagator-jaeger@1.30.1	2.9.0	1
rocketchat/account-service :8.6.1	44af8ac4e711	@opentelemetry/propagator-jaeger@2.7.1	2.9.0	1
rocketchat/authorization-service :8.6.1	6bc18fb5d0e5	@opentelemetry/propagator-jaeger@2.7.1	2.9.0	1
rocketchat/ddp-streamer-service :8.6.1	819771c4abe4	@opentelemetry/propagator-jaeger@2.7.1	2.9.0	1
rocketchat/presence-service :8.6.1	c1170bdfe797	@opentelemetry/propagator-jaeger@2.7.1	2.9.0	1
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
speckle/speckle-server :2.26.3	79f14a2bf931	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
supabase/storage-api :v1.60.4	c8eb9858eafe	@opentelemetry/propagator-jaeger@2.0.1	2.9.0	1
supabase/storage-api :latest	f6c42a04163d	@opentelemetry/propagator-jaeger@2.8.0	2.9.0	1
supabase/storage-api :v1.12.0	f983fb50bd95	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
tenureai/tenure :v1.0.28	5f5b222df9a5	@opentelemetry/propagator-jaeger@2.8.0	2.9.0	1
treskon/portrait-ui :DEV-latest	e7970783bc8d	@opentelemetry/propagator-jaeger@1.12.0	2.9.0	1
ghcr.io/bluesky-social/pds :0.4	d95725b24dbe	@opentelemetry/propagator-jaeger@2.8.0	2.9.0	1
ghcr.io/formancehq/console :console-on.v1.1.1	a4d32c2f68b3	@opentelemetry/propagator-jaeger@1.28.0	2.9.0	1
ghcr.io/formancehq/console-v3 :v1.16.0	c99e8ef2c545	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
ghcr.io/formancehq/portal :v1.16.0	6efef5d19d56	@opentelemetry/propagator-jaeger@1.26.0	2.9.0	1
ghcr.io/immich-app/immich-server :v2.3.1	f8d06a32b1b2	@opentelemetry/propagator-jaeger@2.2.0	2.9.0	1
ghcr.io/middleware-labs/odigos-odiglet :middleware-test-0.0.1	03c8c835ecee	@opentelemetry/propagator-jaeger@1.8.0	2.9.0	1
ghcr.io/middleware-labs/vision-odiglet :middleware-test-0.0.3	bce34c98668e	@opentelemetry/propagator-jaeger@1.8.0	2.9.0	1
ghcr.io/openclaw/openclaw :2026.6.10	af7ea052cf21	@opentelemetry/propagator-jaeger@2.8.0	2.9.0	1
ghcr.io/openclaw/openclaw :2026.5.22	dcfd14877740	@opentelemetry/propagator-jaeger@2.7.1	2.9.0	1
ghcr.io/open-telemetry/demo :1.12.0-frontend	8b348f00ca4c	@opentelemetry/propagator-jaeger@1.25.1	2.9.0	1
ghcr.io/open-telemetry/demo :1.12.0-paymentservice	b0f13eef3abf	@opentelemetry/propagator-jaeger@1.24.1	2.9.0	1
ghcr.io/zazuko/trifid :v6.0.1	59bda2bf65d4	@opentelemetry/propagator-jaeger@2.8.0	2.9.0	1
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	@opentelemetry/propagator-jaeger@2.0.1	2.9.0	1