CVE-2026-126360 OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api

The opentelemetry-api component in OpenTelemetry Python (prior to version 1.45.2 ) is vulnerable to a Denial of Service (DoS) via quadratic-time regular-expression backtracking. The issue occurs within TraceContextTextMapPropagator.extract() when processing a malformed traceparent value containin...

CLSA-2026-1794459660 TuxCare security update for @opentelemetry/instrumentation-tedious (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-tedious to address 1 CVE. Fixed in 0.6.5-tuxcare.1...

CLSA-2026-1794459243 TuxCare security update for @opentelemetry/instrumentation-tedious (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-tedious to address 1 CVE. Fixed in 0.12.0-tuxcare.1...

CLEANSTART-2026-JV06439 OpenTelemetry Python provides the Python API and SDK for OpenTelemetry

Security vulnerability affects the litellm-database package. OpenTelemetry Python provides the Python API and SDK for OpenTelemetry...

CLEANSTART-2026-CF16823 opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API

Security vulnerability affects the sonarqube package. opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API...

CLSA-2026-1794439943 TuxCare security update for @opentelemetry/instrumentation-cassandra-driver (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-cassandra-driver to address 1 CVE. Fixed in 0.40.0-tuxcare.4...

CLSA-2026-1794439793 TuxCare security update for @opentelemetry/instrumentation-mongoose (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.40.0-tuxcare.3...

CLSA-2026-1794439665 TuxCare security update for @opentelemetry/instrumentation-mongoose (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.33.4-tuxcare.1...

CLSA-2026-1794439548 TuxCare security update for @opentelemetry/instrumentation-mysql (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-mysql to address 1 CVE. Fixed in 0.40.0-tuxcare.2...

CLSA-2026-1794438580 TuxCare security update for @opentelemetry/instrumentation-mysql (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-mysql to address 1 CVE. Fixed in 0.34.5-tuxcare.2...

CLSA-2026-1794427289 TuxCare security update for @opentelemetry/instrumentation-mysql2 (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.44.0-tuxcare.2...

CLSA-2026-1794426507 TuxCare security update for @opentelemetry/instrumentation-mysql2 (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.40.0-tuxcare.1...

CLSA-2026-1794425732 TuxCare security update for @opentelemetry/instrumentation-mysql2 (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.34.5-tuxcare.1...

CLSA-2026-1794424748 TuxCare security update for @opentelemetry/instrumentation-pg (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-pg to address 1 CVE. Fixed in 0.43.0-tuxcare.1...

CLSA-2026-1794423755 TuxCare security update for @opentelemetry/instrumentation-cassandra-driver (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-cassandra-driver to address 1 CVE. Fixed in 0.44.0-tuxcare.1...

CLSA-2026-1794423718 TuxCare security update for @opentelemetry/instrumentation-tedious (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-tedious to address 1 CVE. Fixed in 0.27.0-tuxcare.1...

CLSA-2026-1794411722 TuxCare security update for @opentelemetry/instrumentation-pg (1 CVE)

TuxCare rebuilt @opentelemetry/instrumentation-pg to address 1 CVE. Fixed in 0.36.2-tuxcare.1...

CVE-2026-33701-Unsafe-Deserialization-in-OpenTelemetry-Java-Agent-RMI-Instrumentation

CVE-2026-33701 — Unsafe Deserialization in OpenTelemetry Java Agent RMI Instrumentation Severity: Critical CVSS v4.0: 9.3 Affected versions: opentelemetry-javaagent 2.26.1 Patched in: 2.26.1 released March 23, 2026 Overview OpenTelemetry is probably the most widely adopted observability framework...

CVE-2026-116694

A flaw was found in opentelemetry-propagator-jaeger. A remote attacker could trigger a Denial of Service DoS by sending requests containing numerous or oversized baggage header values. Because the inbound values are processed without limits on entry count or total byte size, the application...

MiracleLinux 9 : opentelemetry-collector-0.158.0-2.el9_8 (AXSA:2026-2252:07)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-2252:07 advisory. net/http: golang: golang: Denial of Service via crafted HTTP Range headers CVE-2026-78667 crypto/tls: golang: crypto/tls: Denial of Service via...