GHSA-CG87-VWWH-XVGJ vulnerabilities

Vulnerabilities for packages: argo-cd-fips, crossplane-provider-azure-network, gitlab-rails-ce-fips, caddy-fips, crossplane-provider-azure-storage, gitea-fips, terraform-provider-acme, etcd, opentelemetry-collector, crossplane-provider-aws-route53recoverycontrolconfig-fips, prometheus, k3s, harbo...

GHSA-M9X8-M34X-FJ9Q vulnerabilities

Vulnerabilities for packages: argo-cd-fips, crossplane-provider-azure-network, gitlab-rails-ce-fips, caddy-fips, crossplane-provider-azure-storage, gitea-fips, terraform-provider-acme, etcd, opentelemetry-collector, crossplane-provider-aws-route53recoverycontrolconfig-fips, prometheus, k3s, harbo...

GHSA-W9P8-PVXH-RXPJ vulnerabilities

Vulnerabilities for packages: argo-cd-fips, crossplane-provider-azure-network, gitlab-rails-ce-fips, caddy-fips, crossplane-provider-azure-storage, gitea-fips, terraform-provider-acme, etcd, opentelemetry-collector, crossplane-provider-aws-route53recoverycontrolconfig-fips, prometheus, k3s, harbo...

GHSA-5CV4-JP36-H3MW vulnerabilities

Vulnerabilities for packages: argo-cd-fips, crossplane-provider-azure-network, gitlab-rails-ce-fips, caddy-fips, crossplane-provider-azure-storage, gitea-fips, terraform-provider-acme, etcd, opentelemetry-collector, crossplane-provider-aws-route53recoverycontrolconfig-fips, prometheus, k3s, harbo...

GHSA-WRH2-89VG-4J9G vulnerabilities

Vulnerabilities for packages: argo-cd-fips, crossplane-provider-azure-network, gitlab-rails-ce-fips, caddy-fips, crossplane-provider-azure-storage, gitea-fips, terraform-provider-acme, etcd, opentelemetry-collector, crossplane-provider-aws-route53recoverycontrolconfig-fips, prometheus, k3s, harbo...

CVE-2026-27136 vulnerabilities

Vulnerabilities for packages: argo-cd-fips, crossplane-provider-azure-network, gitlab-rails-ce-fips, caddy-fips, crossplane-provider-azure-storage, gitea-fips, terraform-provider-acme, etcd, opentelemetry-collector, crossplane-provider-aws-route53recoverycontrolconfig-fips, prometheus, k3s, harbo...

Uncontrolled Resource Consumption

go.opentelemetry.io/obi is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to inefficient processing of BPF probe run-count deltas during histogram observation replay, which allows an attacker to trigger excessive CPU consumption on busy systems, leading to a...

RLSA-2026:19135 Important: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to...

opentelemetry-collector security update

An update is available for opentelemetry-collector. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Collector with the supported components for a Rocky Enterpri...

Security Bulletin: IBM CloudPak for Data Scheduling Service is vulnerable to CVE-2026-24051.

Summary OpenTelemetry Collector is used by the CP4D Scheduling Service for telemetry collection. CVE-2026-24051. Vulnerability Details CVEID:CVE-2026-24051 DESCRIPTION: OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the W3CBaggagePropagator function. An attacker can cause excessive memory allocation and CPU consumption by sending oversized baggage data, which is automatically re-injected into...

GHSA-995V-FVRW-C78M opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

Summary go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse without closing it; repeated parsing in a long-running process can exhaust the process file...

opentelemetry-go's Schema ParseFile leaks file descriptors on each parse

Summary go.opentelemetry.io/otel/schema/v1.0 and go.opentelemetry.io/otel/schema/v1.1 leaks one file descriptor on each successful ParseFile call. ParseFile opens the schema file and passes it to Parse without closing it; repeated parsing in a long-running process can exhaust the process file...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the Parse function. An attacker can exhaust CPU resources and generate excessive log output by sending oversized or malformed headers that are processed without length checks. Remediation...

opentelemetry-go's baggage parsing no longer caps raw header length

Summary https://github.com/open-telemetry/opentelemetry-go/pull/7880 removed raw-length rejection and it causes Parse to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Details The commit removes the upfront baggage-string length check and the...

CVE-2026-45292

The CVE-2026-45292 issue affects OpenTelemetry Java components: baggage propagation in opentelemetry-api and opentelemetry-extension-trace-propagators prior to 1.62.0. The vulnerability arises from parsing oversized baggage, causing unbounded memory allocation and high CPU usage, with baggage re-...

CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

EUVD-2026-32953

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...

CVE-2026-45292 opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation

opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API. Prior to 1.62.0, a vulnerability affects the baggage propagation implementation in opentelemetry-api and opentelemetry-extension-trace-propagators...