RHSA-2026:9388HighCVSS 9.1

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release

Published
April 21, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (3)

CVE-2026-32287 →CVE-2026-33186 →CVE-2026-34986 →

📋 Description

CVE-2026-32287 — github.com/antchfx/xpath: github.com/antchfx/xpath: Denial of Service due to infinite loop via boolean XPath expressions CVE-2026-33186 — google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34986 — github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

🎯 Affected products14

  • Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:0174a3a6a65cac3b13423b903c9038baaa37c6c3d6dbeee9918c5f576b4f5d7d_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:7c84cdf31817fe4584a5e8a1589f4c0f09f22aed8f75e6d694143c6a6065d330_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:9ef57417e79d78ca1a623357b5a58c384fdf3a2c954c3587b76cce8983a725e4_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:ff8b32e89a8550c5fac876f5869df8e93ba99b44e49d079a3375f638bc47dfd6_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:270839ae96516ba23c72b7e9edd00df35c675e9043382233119b7f516cad858c_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:529bf355324a078400ca9e9a2dca7b641656cf7b5e735469c5253a2633bf1857_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5496393c7ed9c8f47de5817bf7f2432608b07342e5bfa4f30f4974d1e2a160fd_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:5bfd16612872059e740b630ad3aee5bcad70e91ff197df32fd04c437cc2e3506_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:28a837153e4b73c79ee93082656410084dee8d2a2a52146ad9a41d6fc8623dcb_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:9c862dc8f1ec9c5c2ae2e636a52e62c119e27ce4496343ce07d45e431c93cf99_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbe4340cb78e1bf4452f398f879ddb77a0bd18da35c4780f178887828152497_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ca369b5151f39ae58f0ad3a27722cbf2abda1fffa68176b0075695f583de7ba1_s390x as a component of Red Hat OpenShift distributed tracing 3.9.1

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (7)