SUSE CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

SUSE CVE-2026-41433

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. From 0.4.0 to before 0.8.0, a flaw in the Java agent injection path allows a local attacker controlling a Java workload to overwrite arbitrary host files when Java injection is enabled and OBI is...

CLEANSTART-2026-CD66609 Security fixes in opentelemetry-collector-contrib 0.144.0-r3

Package opentelemetry-collector-contrib version 0.144.0-r3 fixes 1 vulnerabilities: ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-SW69995 Security fixes in opentelemetry-collector-contrib 0.150.0-r0

Package opentelemetry-collector-contrib version 0.150.0-r0 fixes 8 vulnerabilities: CVE-2026-46595, CVE-2026-33816, CVE-2026-39821, CVE-2026-41602, CVE-2026-34986...

CLEANSTART-2026-PI47059 Security fixes in opentelemetry-collector-contrib 0.152.0-r1

Package opentelemetry-collector-contrib version 0.152.0-r1 fixes 2 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-45287...

CLEANSTART-2026-SL88227 Security fixes in opentelemetry-collector-contrib-fips 0.144.0-r3

Package opentelemetry-collector-contrib-fips version 0.144.0-r3 fixes 8 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-33186, CVE-2020-8912...

CLEANSTART-2026-KC95386 Security fixes in opentelemetry-collector-contrib 0.149.0-r0

Package opentelemetry-collector-contrib version 0.149.0-r0 fixes 4 vulnerabilities: ghsa-78h2-9frx-2jm8, ghsa-w8rr-5gcm-pp58, CVE-2026-34986, CVE-2026-39882...

CLEANSTART-2026-HZ36625 Security fixes in opentelemetry-collector-contrib-fips 0.142.0-r0

Package opentelemetry-collector-contrib-fips version 0.142.0-r0 fixes 1 vulnerabilities: ghsa-cfpf-hrx2-8rv6...

EUVD-2026-41151

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords...

EUVD-2026-41152

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the RMI context propagation process. An attacker can cause excessive memory allocation by sending an oversized context propagation payload to a network-reachable RMI endpoint on an...

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion

The RMI context propagation payload reader limits the number of context entries but does not limit the aggregate size of the strings read from the stream. An attacker who can reach an RMI endpoint on an instrumented JVM can send an oversized context propagation payload. This can cause excessive...

Oracle APEX (CVE-2026-54285) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: Third Party OpenTelemetry as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: Third Party OpenTelemetry. Easily exploitable vulnerability allows...

RHSA-2026:19721 Red Hat Security Advisory: opentelemetry-collector security update

Bulletin has no description...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: cluster-api-azure-controller, external-secrets-operator, zot, kwok, kubernetes-csi-external-snapshotter, telegraf, kubeflow-pipelines, rancher-agent, kubernetes-csi-external-attacher, cloud-provider-gcp-cloud-controller-manager, node-feature-discovery, cass-operator,...

GO-2026-5426 Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk

Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk...

GO-2026-5506 OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel

OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel...

GO-2026-5158 Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel...

CVE-2026-56852 vulnerabilities

Vulnerabilities for packages: conftest-fips, argo-workflows, otel-cli, crossplane-provider-aws-cur, harbor-scanner-trivy, crossplane-aws-monolith, crossplane-provider-aws-glue-fips, crossplane-provider-gcp, flyte, avmfix-fips, crossplane-provider-aws-osis, crossplane-provider-aws-sns-fips, perses...

GHSA-JPJM-C3R5-Q96R vulnerabilities

Vulnerabilities for packages: conftest-fips, argo-workflows, otel-cli, crossplane-provider-aws-cur, harbor-scanner-trivy, crossplane-aws-monolith, crossplane-provider-aws-glue-fips, crossplane-provider-gcp, flyte, avmfix-fips, crossplane-provider-aws-osis, crossplane-provider-aws-sns-fips, perses...