CLEANSTART-2026-LD15132 Security fixes for CVE-2020-8912, CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-26958, CVE-2026-27139, CVE-2026-27141, CVE-2026-27142, CVE-2026-33186, ghsa-6g7g-w4f8-9c9x, ghsa-cfpf-hrx2-8rv6, ghsa-fw7p-63qq-7hpr, ghsa-p77j-4mvh-x3m3 applied in versions: 0.142.0-r0, 0.144.0-r0, 0.144.0-r1, 0.144.0-r2, 0.144.0-r3

Multiple security vulnerabilities affect the opentelemetry-collector-contrib-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-SR26977 Security fixes for CVE-2025-68121, CVE-2026-24051, CVE-2026-25679, CVE-2026-26958, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142, CVE-2026-33186, ghsa-6g7g-w4f8-9c9x, ghsa-fw7p-63qq-7hpr, ghsa-p77j-4mvh-x3m3 applied in versions: 0.144.0-r0, 0.144.0-r1, 0.144.0-r2, 0.144.0-r3, 0.144.0-r4

Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-31449

Name of the Vulnerable Software and Affected Versions OpenTelemetry-Go versions prior to 1.43.0 Description The otlp HTTP exporters traces, metrics, logs in OpenTelemetry-Go versions prior to 1.43.0 read the full HTTP response body into an in-memory bytes.Buffer without a size limit. This can lea...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: kubevela, weaviate, malcontent, terragrunt-fips, grafana-alloy-fips, commercial-grafana, ollama-fips, eksctl, witness, loki-fips, mcp-grafana, chainloop-cli-fips, lazygit, deck, grafana-fips, chainloop-control-plane-fips, grafana-beyla, rclone-fips, cri-tools,...

CVE-2026-32285 vulnerabilities

Vulnerabilities for packages: gitlab-runner, nfpm, rclone, teleport, terragrunt, tempo, malcontent, ollama, k8sgpt, dgraph, vcluster, mcp-grafana, prometheus, terraform-mcp-server, datadog-agent, k3s, kubevela, minio, loki, redpanda, opentelemetry-collector-contrib, witness, eksctl,...

CVE-2026-32287 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis, crossplane-provider-aws-eks, crossplane-provider-azure-authorization, crossplane-provider-aws-dynamodb, telegraf, aws-otel-collector, crossplane-provider-aws-rds, tempo, crossplane-provider-aws-firehose,...

Elastic OTel Java 1.10.0 Security Update (ESA-2026-22 / GHSA-xw7x-h9fj-p2c7)

Dependency on Vulnerable Third-Party Component in Elastic OTel Java Leading to Remote Code Execution Dependency on Vulnerable Third-Party Component CWE-1395 exists in Elastic OTel Java via a dependency on OpenTelemetry Java instrumentation library. This vulnerability could allow an attacker to...

CVE-2026-33532 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, opentelemetry-auto-instrumentations-node, prism, argo-workflows, tileserver-gl-fips, opensearch-dashboards, kibana, gemini-cli, drupal, tileserver-gl, langfuse, vitess, redisinsight, lerna, semaphore, opensearch-dashboards-fips, saf, wazuh-dashboard,...

GHSA-48C2-RRV3-QJMP vulnerabilities

Vulnerabilities for packages: kubeflow-katib, opentelemetry-auto-instrumentations-node, prism, argo-workflows, tileserver-gl-fips, opensearch-dashboards, kibana, gemini-cli, drupal, tileserver-gl, langfuse, vitess, redisinsight, lerna, semaphore, opensearch-dashboards-fips, saf, wazuh-dashboard,...

CVE-2026-33701 OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

OpenTelemetry Java Instrumentation provides OpenTelemetry auto-instrumentation and instrumentation libraries for Java. In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. On JDK version 16 and...

ROS-20260327-73-0014

Vulnerability in opentelemetry-collector-contrib related to incorrect resource initialization. Exploitation of the vulnerability may allow an attacker to cause a denial of service...

ROS-20260327-73-0013

Vulnerability in opentelemetry-collector-contrib related to unrestricted resource allocation. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

OpenTelemetry Instrumentation for Java 代码问题漏洞

OpenTelemetry Instrumentation for Java is an open-source Java proxy JAR developed by OpenTelemetry. There were code-related vulnerabilities in versions of OpenTelemetry Instrumentation for Java prior to 2.26.1. These vulnerabilities stemmed from the fact that custom endpoints registered by RMI...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.5 <=4.1.0), dev.vality:shared-resources (>=4.0.0-alpha1 <=4.0.0-alpha4) +1 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=2.15.0 <=2.23.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =2.15.0, =3.8.5, =4.0.0-alpha1, =2.5.12, =2.6.4-hadoop3 Source cves: CVE-2026-33701 Source advisory: SNYK:JAVA-IOOPENTELEMETRYJAVAAGENT-15857172...

io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent-lettuce-5.0 (=0.14.0), io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent-lettuce-5.1 (=0.14.0) +3 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent (=0.14.0)

io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent MAVEN version =0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent.instrumentation:opentelemetry-javaagent and may be impacted: -...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the RMI integration. An attacker can execute arbitrary code with the privileges of the user running the instrumented JVM by sending specially crafted serialized data to a network-exposed JMX or RMI...

GHSA-XW7X-H9FJ-P2C7 OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. Al...

com.sap.hcp.cf.logging:sample-app-spring-boot (>=3.8.0 <=4.1.0), com.weibo:rill-flow-service (>=0.1.3 <=0.1.18) +159 more potentially affected by CVE-2026-33701 via io.opentelemetry.javaagent:opentelemetry-javaagent (>=0.12.1 <=2.23.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version =0.12.1, =3.8.0, =0.1.3, =4.0.0-alpha1, =1.9.0, =0.0.10, =0.2.1, =0.6.2, =0.6.2, =0.80.0, =0.80.0, =0.19.0, =2.5.0, =1.9.0, =1.9.0, =2.3.0 and more Source cves: CVE-2026-33701 Source advisory: OSV:GHSA-XW7X-H9FJ-P2C7...

OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution

In versions prior to 2.26.1, the RMI instrumentation registered a custom endpoint that deserialized incoming data without applying serialization filters. An attacker with network access to a JMX or RMI port on an instrumented JVM could exploit this to potentially achieve remote code execution. Al...

SUSE-SU-2026:1008-1 Security update for Prometheus

This update for Prometheus fixes the following issues: golang-github-prometheus-alertmanager, golang-github-prometheus-nodeexporter: - Internal changes to fix build issues with no impact for customers golang-github-prometheus-prometheus: - Security issues fixed: CVE-2026-27606: Fixed arbitrary fi...