RHSA-2025:9167HighCVSS 7.5

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.6.0 release

Published
June 17, 2025
Last Modified
August 26, 2026

🔗 CVE IDs covered (4)

CVE-2025-29786 →CVE-2025-30204 →CVE-2025-22868 →CVE-2025-27144 →

📋 Description

CVE-2025-22868 — golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws CVE-2025-27144 — go-jose: Go JOSE's Parsing Vulnerable to Denial of Service CVE-2025-29786 — github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input CVE-2025-30204 — golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing

🎯 Affected products14

  • Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:3a4f2fdde35600a6e0a7f947ee2b0f8a75701198b129a39aecce2d1f047181b7_arm64 as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:5e0a98e281698282f6dba8942fbc992cdeb0da30c0f465f39b5c28e86bd7b39a_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:b4ffed36d8f0d575ca959b76e4a22f4197349e277af1586058c18c013feabe28_s390x as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel8@sha256:ed84b0251ae531c31b2c5930f8ba59a64aeda8d96df04accefbeab0899640dee_ppc64le as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:f08e30a5035f1c1bb79d62bc3db9ab19b9b8652c32b8c365e92ceab8abd01090_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:0230ba6094579249356713d21de1f454b7c23a16426661328b978869db9c2e53_arm64 as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:c105cc315f0cac6c42fb3434f6e3c87e58e0dfb25f36ea6fb19016acbf888b86_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:ec808ab1424252f10adb295e8f886ded407aee865017c94ce34723e399b4c335_ppc64le as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-rhel8-operator@sha256:f765a4a9eb745a42721e03609ff3de66fb88cb217b3bf4977a56668e175e4484_s390x as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:2cf4f832dc46517c844b147c118dbc78fd2c17cda5726fe8c27757c601abaa2a_amd64 as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:41d362f767f672bf714049e554014c2cb050b2813388a5ceb6c17f31254b2b71_ppc64le as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:c02bbc2dc27a51bf98da4b0d1d3974ed0428d498eb78bddb9f8d3392e8faa1ea_arm64 as a component of Red Hat OpenShift distributed tracing 3.6.0
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel8@sha256:c397ea8f4c20470a1af7003f93c3c1da9d8b0d4da7313e0f4ad91c4dfa8a9d12_s390x as a component of Red Hat OpenShift distributed tracing 3.6.0

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: To mitigate this vulnerability, it is recommended to pre-validate any payloads passed to `go-jose` to check that they do not contain an excessive amount of `.` characters. Workaround: As a workaround, applications can pre-validate that payloads being passed to Go JOSE do not contain an excessive number of `.` characters. Workaround: To mitigate this vulnerability, it is recommended to impose an input size restriction before parsing (i.e. validating or limiting the length of expression strings that the application will accept). Ensuring no unbounded-length expressions are fed into the parser will prevent the parser from constructing a very large AST and avoid the potential memory exhaustion issue. Workaround: Red Hat Product Security does not have a recommended mitigation at this time.

🔗 References (8)