83 matches found
GHSA-3V2P-HM54-8QCQ OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
Summary @opentelemetry/instrumentation-http redacts sensitive URL query parameters on outgoing client spans but not on incoming server spans. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL...
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
Summary @opentelemetry/instrumentation-http redacts sensitive URL query parameters on outgoing client spans but not on incoming server spans. The server-span path writes the raw query string verbatim into the url.query attribute, so credentials embedded in inbound request URLs — AWS presigned-URL...
CVE-2026-128080
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing...
EUVD-2026-125687
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing...
CVE-2026-128080 OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing...
CVE-2026-128080
The @opentelemetry/instrumentation-http component within the OpenTelemetry JavaScript client (versions 0.204.0 through 0.222.0 ) is vulnerable to the exposure of sensitive information. The root cause is that the library writes raw query strings from incoming HTTP requests to the url.query server-...
CLSA-2026-1794459660 TuxCare security update for @opentelemetry/instrumentation-tedious (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-tedious to address 1 CVE. Fixed in 0.6.5-tuxcare.1...
CLSA-2026-1794459243 TuxCare security update for @opentelemetry/instrumentation-tedious (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-tedious to address 1 CVE. Fixed in 0.12.0-tuxcare.1...
CLSA-2026-1794439943 TuxCare security update for @opentelemetry/instrumentation-cassandra-driver (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-cassandra-driver to address 1 CVE. Fixed in 0.40.0-tuxcare.4...
CLSA-2026-1794439793 TuxCare security update for @opentelemetry/instrumentation-mongoose (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.40.0-tuxcare.3...
CLSA-2026-1794439665 TuxCare security update for @opentelemetry/instrumentation-mongoose (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mongoose to address 1 CVE. Fixed in 0.33.4-tuxcare.1...
CLSA-2026-1794439548 TuxCare security update for @opentelemetry/instrumentation-mysql (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mysql to address 1 CVE. Fixed in 0.40.0-tuxcare.2...
CLSA-2026-1794438580 TuxCare security update for @opentelemetry/instrumentation-mysql (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mysql to address 1 CVE. Fixed in 0.34.5-tuxcare.2...
CLSA-2026-1794427289 TuxCare security update for @opentelemetry/instrumentation-mysql2 (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.44.0-tuxcare.2...
CLSA-2026-1794426507 TuxCare security update for @opentelemetry/instrumentation-mysql2 (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.40.0-tuxcare.1...
CLSA-2026-1794425732 TuxCare security update for @opentelemetry/instrumentation-mysql2 (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-mysql2 to address 1 CVE. Fixed in 0.34.5-tuxcare.1...
CLSA-2026-1794424748 TuxCare security update for @opentelemetry/instrumentation-pg (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-pg to address 1 CVE. Fixed in 0.43.0-tuxcare.1...
CLSA-2026-1794423755 TuxCare security update for @opentelemetry/instrumentation-cassandra-driver (1 CVE)
TuxCare rebuilt @opentelemetry/instrumentation-cassandra-driver to address 1 CVE. Fixed in 0.44.0-tuxcare.1...