Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.20.0-0.8.hum1 aarch64, x8664 jaeger-2.20.0-0.8.hum1.src src Security Fixes: jaeger: CVE-2026-62995...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.20.0-0.5.hum1 aarch64, x8664 jaeger-2.20.0-0.5.hum1.src src Security Fixes: jaeger: CVE-2026-48586 CVE-2026-55969...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.20.0-0.4.hum1 aarch64, x8664 jaeger-2.20.0-0.4.hum1.src src Security Fixes: jaeger: CVE-2026-48586...

EUVD-2026-42324

OpenTelemetry JavaScript: Denial of service in JaegerPropagator via unhandled exception on a malformed header...

OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

Summary @opentelemetry/propagator-jaeger decodes incoming HTTP header values with decodeURIComponent without handling decode errors. A single request carrying a malformed percent-encoded value for example a bare % in an uber-trace-id or uberctx- header throws an uncaught URIError, terminating any...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.19.0-1.1.hum1 aarch64, x8664 jaeger-2.19.0-1.1.hum1.src src Security Fixes: jaeger: CVE-2026-59884 CVE-2026-59885...

CVE-2026-59892

A flaw was found in the @opentelemetry/propagator-jaeger component of OpenTelemetry JavaScript. This vulnerability allows an unauthenticated remote attacker to send specially crafted HTTP header values, specifically uber-trace-id and uberctx-. The component improperly decodes these values without...

CVE-2026-59892

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...

CVE-2026-59892

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...

CVE-2026-59892 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx- HTTP header values with decodeURIComponent without handling decode errors, allowing an unauthenticated remote attacker to send a malformed...

CVE-2026-59892

Summary: OpenTelemetry JavaScript’s JaegerPropagator (via @opentelemetry/propagator-jaeger) decodes uber-trace-id and uberctx-* headers with decodeURIComponent() without handling decode errors prior to 2.9.0, enabling an unauthenticated attacker to send a malformed percent-encoded value that resu...

PT-2026-56504

Name of the Vulnerable Software and Affected Versions @opentelemetry/propagator-jaeger versions prior to 2.9.0 Description The @opentelemetry/propagator-jaeger component decodes incoming uber-trace-id and uberctx- HTTP header values using the decodeURIComponent function without proper error...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: jaeger: jaeger-2.19.0-1.hum1 aarch64, x8664 jaeger-2.19.0-1.hum1.src src...

CVE-2026-41078

OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under...

CVE-2026-40894

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators...

FreeBSD : Grafana -- XSS in Grafana Explore stack trace (6cc28c49-58fe-11f1-b525-3c7c3fba4204)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 6cc28c49-58fe-11f1-b525-3c7c3fba4204 advisory. https://grafana.com/security/security-advisories/cve-2025-41117 reports: Stack traces in Grafana's...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: k8sgpt, opentelemetry-collector, opentelemetry-operator, telegraf, tempo, fluent-bit-plugin-loki, jaeger, amazon-cloudwatch-agent-operator, splunk-otel-collector, aws-otel-collector, prometheus-pushgateway, istio, minio-operator, metrics-server, mcp-grafana,...

CVE-2026-44903 vulnerabilities

Vulnerabilities for packages: karma-fips, k8sgpt, opentelemetry-collector-contrib, prometheus, tempo, amazon-cloudwatch-agent-operator-fips, minio-operator, amazon-cloudwatch-agent-operator, certificate-transparency-fips, cloudzero-agent-fips, fluent-bit-plugin-loki, opentelemetry-operator,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: k8sgpt, opentelemetry-collector, opentelemetry-operator, telegraf, tempo, fluent-bit-plugin-loki, jaeger, amazon-cloudwatch-agent-operator, splunk-otel-collector, aws-otel-collector, prometheus-pushgateway, istio, minio-operator, metrics-server, mcp-grafana,...

GHSA-FW8G-CG8F-9J28 vulnerabilities

Vulnerabilities for packages: karma-fips, k8sgpt, opentelemetry-collector-contrib, prometheus, tempo, amazon-cloudwatch-agent-operator-fips, minio-operator, amazon-cloudwatch-agent-operator, certificate-transparency-fips, cloudzero-agent-fips, fluent-bit-plugin-loki, opentelemetry-operator,...