Package
datadog-cluster-agent-7.75
Component
go.opentelemetry.io/otel
Latest update
5.3
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Justification
Impact
False positive -- component mis-attribution. CVE-2026-39882 (GO-2026-4985, GHSA-w8rr-5gcm-pp58; CVSS 5.3) affects ONLY the OpenTelemetry OTLP HTTP exporter submodules per the upstream advisory (verified against the GHSA affected-packages list): go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp (< 1.43.0), go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp (< 1.43.0), and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp (< 0.19.0). The vulnerable code is the unbounded io.Copy(&respData, resp.Body) in each exporter client. This detection is on the CORE go.opentelemetry.io/otel module -- a distinct Go module that does not contain the vulnerable exporter-client code and is NOT listed as affected by GHSA-w8rr-5gcm-pp58. grype's match carries only the coarse CVE alias (NVD CPE, which cannot express Go-module granularity), not the GHSA label -- the known grype OpenTelemetry core-module false-positive pattern. The genuine exposure (the otlptracehttp exporter, which datadog-agent-7.75 ships at v1.39.0) is separately tracked and dispositioned fix-not-planned on the affected exporter component. This determination applies only to the mis-attributed core go.opentelemetry.io/otel component.
Status