RHSA-2026:14885HighCVSS 9.1

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3 release

Published
May 7, 2026
Last Modified
August 24, 2026

🔗 CVE IDs covered (6)

CVE-2026-41602 →CVE-2026-41603 →CVE-2026-41604 →CVE-2026-41605 →CVE-2026-41606 →CVE-2026-41607 →

📋 Description

CVE-2026-41602 — github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation CVE-2026-41603 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation CVE-2026-41604 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability CVE-2026-41605 — Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability CVE-2026-41606 — Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion CVE-2026-41607 — Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability

🎯 Affected products26

  • Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:20951bbce71da848cf595ae1480a0c46b131b59190fd657774a8932889a8e5da_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:37069c4ac61fc810096df8c25b1d12f95b04da5f11892fb4c6bcd3a3479d3777_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3bdaf268da97b95f85a09a18e42e2cfe61ee56b0131b6f86ac4a41fac4854650_s390x as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:94fa2f56d060b2ac8a384db29bf073683bef50cd60724e893ee1dcb945424517_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:58739fdf7b671103fddd089db340747090d46018435d2f6519fb00436f08684f_s390x as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:841e1897e543548f5494c9495463514d4286697a760326b67c11958933a7ac70_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:d1a3996d3879700be89bad37bb688f5016078a11dbdda894932115da370508ee_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:e78a27a6a17ad3f2bd5771ada6ac2357156cd351dc3e976d0495fcdc38a4d891_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:bea6c0fb2bead67356a76060901018b90c2cda12e5ef0ffca8993e16b761ab41_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:cf73a80390a85a34b6b95a097a3e00c0ac5ed1e6e0bd396c1f55233b59de70ef_s390x as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:d21b8336c12507aabdb03ecee43d5e93633b202ea880ae6aced0426b40d972f6_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:f6e5c856ec74d0a7e858448960c4d09d2a24ac7bdce7ff18d1981bd23a45d6cb_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:9aca25cbc3ab1ba653d3b427df28f2b5ec1c4c041892e5e7ebd817be0ac56017_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:50bd4b1c745b916a8127a071e9d79dbde85268ab19c49ffb431863f9222152f6_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:5e922a6dc5973688e531cb1bcbb7a9a414f260d64be9c0a66701b7c050f8ed65_s390x as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:745c62848b8ab43bbcddf75a79b53662e0ac0aff050281c879e01c4c213accc3_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d7c013a4088c668aacbc00047f00cb1cc0041676f9f8d5a9971ab53fd15d5a69_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0fd2089ab716a8733ccdaa909eb7d8663c69de0c87cfc6551ca5a7b93c295a7b_s390x as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:815f222ec62bad59caede1682990af6367fcc4354013b5da96a7b67dd311a4b9_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:a12c6e4a54dfe009700be799c8036a09a8845bc84dea533c024ffac0a65dc491_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e2c38ca7fa1257940589d6eace9ad5d95c6dbaccf36ae04ce296d0350258e0a0_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:3345dc986a756c37e0636877a17dfa8483d12338e67d522419e85667f65cfa3e_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:5f227627f918d7a8b6328843da37547b54271ea93045b9a5d9ede82348b62d01_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:cb81f87ad3ed182494ec8f8f4d2a0229a28b716ae27f946d221077961534d9cc_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:f9a90f6a24678435a08a9783ac7612629b0702633b9405540b02eb5a6da4c6c9_s390x as a component of Red Hat OpenShift distributed tracing 3.9.0

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators

🔗 References (10)