RHSA-2026:54773HighCVSS 7.8

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.10.2 release

Published
August 13, 2026
Last Modified
August 19, 2026

🔗 CVE IDs covered (5)

CVE-2026-41178 →CVE-2026-42505 →CVE-2026-46600 →CVE-2026-56852 →CVE-2026-39822 →

📋 Description

CVE-2026-39822 — golang: Go os.Root: Symlink following vulnerability allows directory traversal CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42505 — crypto/tls: golang: Go crypto/tls: Information disclosure in Encrypted Client Hello CVE-2026-46600 — golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

🎯 Affected products14

  • Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:2ecb3b747ea5a5bb9deba0671b67c13637abfe7683285e0d4bb082fffe486cef_s390x as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:4daff72e5257f71fe794493fa1f27b57719589e638538415daf0d85f1a803e67_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5fbadafe265cf3a6b7994e2185ab80637fb7c948660fe5bde736e4491c02df8c_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:a151f50548894ffd4de491bfa60ef61f3b6e3b63bbb2ebd2e8ef75c8f57ad05b_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:cbb89b45c9bc69e2b2f13c9be41330675f90e961fc91f5f0daf8dbb894c80141_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:237f26db42385fcc3d9e68488e8d0364188b3d7f2e51f116dd787a0a77573c8c_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:65d22c3675dcf5c5b6f02439d551a642288f5fe8cf47d22224d90eb8e00dc4ce_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:abef9f5d634f690962567b4c6aece4d8b2d1d4f3ededdac4a82ef80c9bde3f0b_s390x as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:e31d5bcb7f377991379b5b7937a24bfabbd70e71fec7f52a7baa0f1395f46b1c_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:4513b678c1fd5685ae53f5eca152885e7469a22e6beddd16213c9ad07b34cb74_arm64 as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:951749ffe7b80087f603963c246ba8fe6e302a32f767c73dd77993760720328f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a471bb659af2f377be4a0f9e5457b0d5f304c292e4c3cb6f977332e110244264_amd64 as a component of Red Hat OpenShift distributed tracing 3.10.1
  • registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a6ca99af9e3f5135fea5e9cf79bf57b0b52af3fe4e65ee803aee6d4f507c0642_s390x as a component of Red Hat OpenShift distributed tracing 3.10.1

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: There is no mitigation for this issue other than updating the Go toolchain to Go 1.25.12 or Go 1.26.5. Programs compiled with Go >= 1.24 that do not use the os.Root API are not affected by this vulnerability. The os.Root API was introduced in Go 1.24. Go versions prior to 1.24 are not affected. This issue is fixed in Go 1.25.12 and Go 1.26.5. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

🔗 References (9)