Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules

Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to multiple vulnerabilities due to Node.js modules undici, js-yaml, fast-uri, protobufjs and @opentelemetry/core...

SUSE CVE-2026-39882

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

CLEANSTART-2026-CD66609 Security fixes in opentelemetry-collector-contrib 0.144.0-r3

Package opentelemetry-collector-contrib version 0.144.0-r3 fixes 1 vulnerabilities: ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-PI47059 Security fixes in opentelemetry-collector-contrib 0.152.0-r1

Package opentelemetry-collector-contrib version 0.152.0-r1 fixes 2 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-45287...

CLEANSTART-2026-KC95386 Security fixes in opentelemetry-collector-contrib 0.149.0-r0

Package opentelemetry-collector-contrib version 0.149.0-r0 fixes 4 vulnerabilities: ghsa-78h2-9frx-2jm8, ghsa-w8rr-5gcm-pp58, CVE-2026-34986, CVE-2026-39882...

CLEANSTART-2026-SL88227 Security fixes in opentelemetry-collector-contrib-fips 0.144.0-r3

Package opentelemetry-collector-contrib-fips version 0.144.0-r3 fixes 8 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, CVE-2026-33186, CVE-2020-8912...

CLEANSTART-2026-SW69995 Security fixes in opentelemetry-collector-contrib 0.150.0-r0

Package opentelemetry-collector-contrib version 0.150.0-r0 fixes 8 vulnerabilities: CVE-2026-46595, CVE-2026-33816, CVE-2026-39821, CVE-2026-41602, CVE-2026-34986...

CLEANSTART-2026-HZ36625 Security fixes in opentelemetry-collector-contrib-fips 0.142.0-r0

Package opentelemetry-collector-contrib-fips version 0.142.0-r0 fixes 1 vulnerabilities: ghsa-cfpf-hrx2-8rv6...

EUVD-2026-41151

OpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text Passwords...

EUVD-2026-41152

OpenTelemetry Javaagent RMI context propagation allows resource exhaustion...

Oracle APEX (CVE-2026-54285) (July 2026 CPU)

The remote host is affected by a vulnerability in Oracle APEX component: Third Party OpenTelemetry as referenced in the July 2026 Oracle Critical Patch Update CPU advisory. - Vulnerability in the Oracle APEX product component: Third Party OpenTelemetry. Easily exploitable vulnerability allows...

RHSA-2026:19721 Red Hat Security Advisory: opentelemetry-collector security update

Bulletin has no description...

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: hubble, pulumi-kubernetes-operator, datadog-agent, k3s, telegraf, rancher-system-agent, cluster-api-gcp-controller, apisix-ingress-controller, cluster-api-aws-controller, zot, cilium, helm-operator, flux-helm-controller, kapp-controller, cert-manager-webhook-pdns,...

GO-2026-5426 Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk

Opentelemetry-go: BSD kenv command not using absolute path enables PATH hijacking in go.opentelemetry.io/otel/sdk...

GO-2026-5506 OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel

OpenTelemetry-Go: Multi-value baggage header extraction causes excessive allocations in go.opentelemetry.io/otel...

GO-2026-5158 Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel

Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel...

CVE-2026-56852 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-applicationinsights, controller-gen, crossplane-provider-aws-kafka-fips, crossplane-provider-aws-networkmanager, k6-fips, verticadb-operator-fips, falco-no-driver, crossplane-provider-aws-kms, knative-kafka-broker, omnibump,...

GHSA-JPJM-C3R5-Q96R vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-applicationinsights, controller-gen, crossplane-provider-aws-kafka-fips, crossplane-provider-aws-networkmanager, k6-fips, verticadb-operator-fips, falco-no-driver, crossplane-provider-aws-kms, knative-kafka-broker, omnibump,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector: opentelemetry-collector-0.157.0-0.1.hum1 aarch64, x8664 opentelemetry-collector-0.157.0-0.1.hum1.src src Security Fixes: opentelemetry-collector: CVE-2026-56852...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector-contrib: opentelemetry-collector-contrib-0.157.0-0.1.hum1 aarch64, x8664 opentelemetry-collector-contrib-0.157.0-0.1.hum1.src src...