A security vulnerability (CVE-2026-39882) affects the kedacore-http-add-on package, which uses OpenTelemetry-Go, the Go implementation of OpenTelemetry. Versions prior to 0.13.0-r2 are affected. The vulnerability has a medium severity with a CVSS score of 5.3 and impacts availability without affecting confidentiality or integrity. A patch is available in version 0.13.0-r2.