RHSA-2026:3459HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.9.0 release

Published
February 26, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (3)

CVE-2025-68121 →CVE-2025-61726 →CVE-2025-61729 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61729 — crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

🎯 Affected products26

  • Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:a03e51634b01763f1f4ef7d74c1927919430d1fa1e4c37de3e1541b7dcf07b7c_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:bfce7a25f48e52508ea06d5cbfa2713ba34001108d1300fa997278b8adbd602a_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:cd55f3750867fa478f118f6f24cc34ab1778a29b3e46665408874d945df7dab9_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:fc56b8131efe2bd94900d237b8cedf72ddc917e269c9a8277852cb3eeb65aa50_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:16060709000e2eadd2a67e70c07169673d8a5dd17e2a0c3773f00f2ed70a2387_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:5d876965288712d82ad017e5838ca5b9c4fa507c8c7c14ceb404a020113d8396_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:76a0a2fba9632bd614adc12eb35df686f2502c71cfdbf699a1c3d2bb62871d29_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:f406407af8056cdf664bc525ca91dba35cb047f57b6072c0611567b9d52639a7_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:4d8aacf31e9e78db9aa8f9722e89c1999da5033b9e6716c3853845cc3b1e06f5_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:8fd5701262304469820b1103a5aefbd5a63200bbb106cd81e1f402548812a932_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c90c7540ee2549fa430f5fd42b7e2a6183e0027fa11514151496b56e235b610c_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:da4e907fcbb808128b23afd41d4651555dcff11db2e361adc1bfac1f231db4aa_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:90d1a71febb6cac99b64fc4863bcb66b11aa18c30dad93b244aca3290c3574e0_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0bf8e0ac0183cc9c0bb8011261945562fc848f92083770f009babf55a76d97aa_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:52f9517cb0d07549162a971c4969fe1319a2fb287135f54e1344065ef516883d_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:64493ed24c50692ef9cd6150737102d98ae120b6dba1599fdd6f13dff4c783a3_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:cee195d4549093a1d9d161b243a1373368560f8bd578a57e5e2f5a2239801b99_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:0acc5e1a59997d41552c51e2be79e7f40c8b91a2ee55d7c1efc9e0cd7960de9a_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:836fe86ff3d2beeedfb4eeea334e06f971a216fe903b846a1186c2fb77024b45_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:dc6eb4ba236ba188753f3c44134e76b95b56d3f6c85a05dc298885da72c0a8dd_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ecf05fcb9614dfaab20783e9218f418497eaddd42b0d51a32a8034c52070376e_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:2c607d3ab16a5576481d060c5022a60aded5105169b44a02036fa6f37a169953_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:3012a6730ca532de4dc6d524279e9c9f04b69afeaec81c3fc2df43bfc1c888b7_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:c665ee88b56ebe02f4d2260262bb044647d900a17958ac9dae3932d240ceac09_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:df88c2ddadcc28f76718d9965867aa4bcfb55d8b891184b54755e4d1be68ebd1_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (7)