Vulnerability Reportotel/opentelemetry-collector-contrib:0.162.0

otel/opentelemetry-collector-contrib:0.162.0

digestsha256:39923a8e431bd1f57be82411999d389fcfe40857492e4365456d97a4c1f74be6

Executive Summary

Last scanned: Nov 2, 2026

Threat ScoreCAUTION• CVE-2026-78669 in golang.org/x/net (v0.59.0) lets a remote peer send HTTP/2 SETTINGS floods that drive up CPU on the collector, which can slow or stall telemetry intake on the OTLP ports that are reachable in normal operation.• CVE-2026-78659 in golang.org/x/net (v0.59.0) can exhaust collector memory through HTTP/2 trailers, which can cause slowdowns or restarts of telemetry ingestion.• The scan found 18 exposed-surface findings, 4 of them rated 7.0 or higher and 7 rated 6.0 or higher, with a maximum severity of 7.5.• None of the flagged exposed-surface findings are listed as known to be actively exploited, and their impact is denial of service rather than code execution or data access.• CVE-2026-78660 and CVE-2026-97031 only apply when the collector is set up as a reverse proxy or has TLS enabled on a receiver, so they are not relevant to a default receiver deployment.• Post-compromise findings are minor, with a maximum severity of 2.7, and the image publisher is rated RELIABLE.

58/100CAUTION

ReputationPOPULAR COMMUNITY• High Reputation Community Image (1404M+ pulls)• Pinned by digest (Immutable)

RELIABLE

This image carries significant risk; production deployment is highly discouraged without strict compensating controls. A remote client reaching the OTLP receivers on ports 4317 and 4318 could exhaust CPU or memory through the HTTP/2 flaws in golang.org/x/net, causing telemetry intake to stall or the collector to restart. CVE-2026-78669 and CVE-2026-78659 are the most significant items, and both are denial-of-service issues rather than paths to code execution or data theft. CVE-2026-97031 and CVE-2026-78660 only matter if TLS is enabled on a receiver or the collector is used as a reverse proxy, so confirm those settings before rating them as relevant. No single compensating control was identified that fully removes the HTTP/2 denial-of-service exposure, so the Go dependency should be updated to a fixed release before production use.

Hardening plan for this image · 4 steps. The first cuts risk from 58 to 0.

Included in Pro

Scanning procedure

Vulnerability scan
Full CVE sweep across OS packages and app dependencies
Exploitability check
CVEs ranked by exploit probability (EPSS) and matched against CISA KEV
Reachability analysis
Symbol-level proof: is the vulnerable code even linked and callable in your binaries?
Runtime verification
Live-container probes: exposed endpoints, feature flags, real defaults
Supply chain analysis
Base-image lineage, package provenance and signatures — nothing slipped in unnoticed
Hardening recommendations
A hardened build plan — patch, remove unused packages, lock down the runtime — with parity tests proving nothing broke

Vulnerabilities

Vulnerability Log

20 total

CVE ID	Adjusted Severity	Package	Exploit Probability	Risk Context
CVE-2026-78669	HIGH7.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78659	HIGH7.5	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78669	HIGH7.5	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78659	HIGH7.5	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78660	MEDIUM6	golang.org/x/net v0.59.0 fixed in 0.60.0	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97031	MEDIUM6	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78660	MEDIUM6	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-97032	MEDIUM5.9	golang.org/x/net v0.59.0 fixed in 0.60.0	0.5% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-97032	MEDIUM5.9	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-111943	MEDIUM5.44	stdlib v1.26.8 fixed in 1.26.10, 1.27.3	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
CVE-2026-78663	MEDIUM5.3	golang.org/x/net v0.59.0 fixed in 0.60.0	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-78663	MEDIUM5.3	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly ExposedContext importance: HIGH
CVE-2026-94439	MEDIUM5.2	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.4% Theoretical Threat	Directly ExposedContext importance: MEDIUM
GO-2026-5932	MEDIUM4	golang.org/x/crypto v0.57.0 No fix yet	—	Directly Exposed
CVE-2026-56866	LOW3.9	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Directly Exposed
CVE-2026-94448	LOW3.66	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-97030	LOW3.66	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.3% Theoretical Threat	Directly Exposed
CVE-2026-56857	LOW3.3	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.6% Theoretical Threat	Directly Exposed
CVE-2026-78667	LOW2.7	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Post-Exploit
CVE-2026-94440	LOW2.7	stdlib v1.26.8 fixed in 1.26.9, 1.27.2	0.5% Theoretical Threat	Post-Exploit

Want to check another image? Run a full scan with the Docker Security Scanner.