RHSA-2026:65343HighCVSS 8.1

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release

Published
September 8, 2026
Last Modified
September 11, 2026

🔗 CVE IDs covered (12)

CVE-2026-41178 →CVE-2026-48586 →CVE-2026-56852 →CVE-2026-56858 →CVE-2026-32283 →CVE-2026-33818 →CVE-2026-42502 →CVE-2026-55969 →CVE-2026-56853 →CVE-2026-56859 →CVE-2026-56860 →CVE-2026-56862 →

📋 Description

CVE-2026-32283 — crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages CVE-2026-33818 — encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-41178 — github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers CVE-2026-42502 — golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering CVE-2026-48586 — thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data CVE-2026-55969 — thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound CVE-2026-56852 — golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input CVE-2026-56853 — net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service CVE-2026-56858 — html/template: golang: Go html/template: Cross-Site Scripting via pathological input CVE-2026-56859 — encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue CVE-2026-56860 — net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56862 — crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

🎯 Affected products26

  • Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.

🔗 References (16)