RHSA-2026:14162HighCVSS 7.8

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release

Published
May 6, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (5)

CVE-2026-4878 →CVE-2026-29111 →CVE-2026-32280 →CVE-2026-32283 →CVE-2026-41602 →

📋 Description

CVE-2026-4878 — libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file() CVE-2026-29111 — systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data CVE-2026-32280 — crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-41602 — github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation

🎯 Affected products14

  • Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)