RHSA-2026:94580HighCVSS 7.5

Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.4 release

Published
November 3, 2026
Last Modified
November 4, 2026

🔗 CVE IDs covered (2)

CVE-2026-116591 →CVE-2026-118664 →

📋 Description

CVE-2026-116591 — github.com/klauspost/compress/zstd: klauspost/compress: Denial of Service via crafted zstd compressed input CVE-2026-118664 — decode-uri-component: decode-uri-component: Denial of Service via malformed percent-encoded input

🎯 Affected products26

  • Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3db0a120b4c83d0f6e52b54124986cba92c1113f41a8d154f67b3c2a77ee3d4b_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:6d3cf915fcf9d58f008e6822a572d0f6512511fe18b9d81ff7d160b46b078c99_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:dbb5a0a97bd91220b03654dd9540efbee6780ace37f358348923aec6063ea8c3_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:f9149873642db30881441fcfe510462cb4b8baa9c20ec3239d26bc9c62da0298_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:03693729253711f989703f56b0909d7d418e3bfd18d3f880e5dc58e738baa306_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:83d0dc0390c0e022d65ea4f6c39bbee61bde4c82a35e89cb26a69cce847aceff_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:95b3afa22b841f1e25dca7a731bfaaee9d7c9e07de9308172d347e86fbfcd156_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:eb71eb866edaf9c5f065e2125918ed246a7c973c0a129ab69ec11b1982a2456e_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:59c022dde92c26ede7372be017526e99a3431e6f0914dbbea0d24320716ab827_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:91aba696dbfe32099f5cef2a0c18545915746da0a6e1009f372b1d65ef995bf1_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:a1aa0e187f494d581a4a2a9c68181866868b27d9cff7876cdd1a03e9aebc85db_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aa0864518604acf988922e5fa022aa9e2dd7f45666118868f429d399c38e5cfd_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:7025be09dbb8c0a34558337466d7a570125b32af71b1d1f9f711e910291a21f5_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0eb1f3fd52653b3b6268602d31a80b87c7f2ffc6ae23219de6e5387268fdcebf_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:7c94f193f833a545a77363629240c8cbb6abfc062a4602240c907eb5ac0ff784_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:bbaf77e627faba5a43bf3c851baa4cbb064a5ae60910f97804fdec7f31e6db9d_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:e3a451b6acbee73923ab58976a4b64093fb72d794734933231bfcb38152347c1_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:609c005abb679898d229e858a82c0ba9c17fb951b308d26a687a64dd2bbc3d55_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:abf5b534a6a43a7c9747a05ec9fd954e9ffd50111e1f8f468d978c7d1c008922_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:c806636798ef8c4328884f302ec86ae0f7eb2032e8ddd4feeb96ba2ac43b25ab_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:e40f19fa37b84933cc4df156253a8eb261e961b1b8fe9bf7f111d424a75c6ada_s390x as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:374b006eef7ceab3211c9c96f7203fdf8c6bc6180290efb912aa0efbc4f31125_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:6d6052c6b3ad042f23c982bc84c67390bf4fbf6443f4fe3a6c930726d72d3588_arm64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:cf93541524a9dffa693004d57afbbe0cbc0225799884e9606a92bcace832a219_amd64 as a component of Red Hat OpenShift distributed tracing 3.11
  • registry.redhat.io/rhosdt/tempo-rhel9@sha256:d90167e6cccd445f33c090c570dee352dd3778b7ac9b8572d9e40a6e09179fbb_s390x as a component of Red Hat OpenShift distributed tracing 3.11

✅ Remediation

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators Workaround: Reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. No direct configuration-level workaround exists within the library itself. --- CME Mitigation Guidance (2026-11-03) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to enforce bounds on parsed count values and decode-table indices in klauspost/compress zstd decompression routines to prevent integer wraparound and out-of-bounds indexing: upgrade to klauspost/compress 1.20.2+ (or the corresponding fixed Red Hat builds), which reject counts exceeding math.MaxInt16 in readNCount, restrict Huffman-weight FSE tableLog values to 6 in huff0.ReadTable, and adjust count validation in validateNorm, closing crafted two-block zstd compressed stream. Until patched, this is a concern on applications decompressing untrusted Zstandard (zstd) input using klauspost/compress DecodeAll or streaming decoder, so reject or filter untrusted Zstandard-compressed payloads at ingress proxies, or restrict decompression endpoints to authenticated, trusted clients. These controls limit blast radius and contain exploitation, but they do not fix the underlying integer wraparound defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)

🔗 References (6)