CLEANSTART-2026-QH85825 Security fixes in opentelemetry-collector-contrib 0.153.0-r2

Package opentelemetry-collector-contrib version 0.153.0-r2 fixes 5 vulnerabilities: CVE-2026-2303, CVE-2026-46384, ghsa-mc57-h6j3-3hmv, CVE-2026-46385, ghsa-w8j3-pq8g-8m7w...

CVE-2026-46385 vulnerabilities

Vulnerabilities for packages: bento, opentelemetry-collector-contrib, dapr, splunk-otel-collector...

Linux Distros Unpatched Vulnerability : CVE-2026-46385

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking...

CVE-2026-46385

creationtimestamp| type| source ---|---|--- 2026-05-29 21:49:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzjcgcjw427...

CVE-2026-46385 iskorotkov/avro: CPU Exhaustion in Avro Decoder

iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count as a Go int, which is 64-bit on amd64 ...