RHSA-2025:23664 Red Hat Security Advisory: opentelemetry-collector security update

Bulletin has no description...

RHEL 10 : opentelemetry-collector (RHSA-2025:23664)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:23664 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: github.com/expr-lang/expr: Expr: Denial of Service via...

ALSA-2025:23664 Important: opentelemetry-collector security update

Collector with the supported components for a AlmaLinux build of OpenTelemetry Security Fixes: github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation CVE-2025-68156 For more details about the security issues, including the impact, a CVSS score,...

This Week in Spring - Spring Boot 4 edition! - November 25th, 2025

Hi, Spring fans! Welcome to another illustrious installment of This Week in Spring! It’s Thanksgiving week here in the United States. Thanksgiving is traditionally celebrated with friends and family every fourth Thursday of November, gathered around a table full of food and, usually, a giant...

TencentOS Server 4: grafana (TSSA-2024:0907)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0907 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

CVE-2025-63811 vulnerabilities

Vulnerabilities for packages: cluster-api-aws-controller, opentelemetry-collector-contrib, bento, amazon-cloudwatch-agent, sqlexporter, splunk-otel-collector, jitsucom-bulker, argo-events, grafana-alloy...

GHSA-9MJ6-HXHV-W67J vulnerabilities

Vulnerabilities for packages: cluster-api-aws-controller, opentelemetry-collector-contrib, bento, amazon-cloudwatch-agent, sqlexporter, splunk-otel-collector, jitsucom-bulker, argo-events, grafana-alloy...

CVE-2025-63811 vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, cluster-api-aws-controller-fips, argo-events-fips, cluster-api-aws-controller, bento, amazon-cloudwatch-agent-fips, grafana-alloy, vault, sqlexporter, amazon-cloudwatch-agent, opentelemetry-collector-contrib, vault-fips, jitsucom-bulker,...

GHSA-9MJ6-HXHV-W67J vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, cluster-api-aws-controller-fips, argo-events-fips, cluster-api-aws-controller, bento, amazon-cloudwatch-agent-fips, grafana-alloy, vault, sqlexporter, amazon-cloudwatch-agent, opentelemetry-collector-contrib, vault-fips, jitsucom-bulker,...

RUSTSEC-2025-0123 opentelemetry-jaeger crate is unmaintained

The opentelemetry-jaeger crate is deprecated and no longer actively maintained. The Jaeger propagator implementation has been migrated to opentelemetry-jaeger-propagator. More information and examples of using OTLP with Jaeger can be found in Introducing native support for OpenTelemetry in Jaeger...

opentelemetry-jaeger crate is unmaintained

The opentelemetry-jaeger crate is deprecated and no longer actively maintained. The Jaeger propagator implementation has been migrated to opentelemetry-jaeger-propagator. More information and examples of using OTLP with Jaeger can be found in Introducing native support for OpenTelemetry in Jaeger...

actix-web-opentelemetry (>=0.2.0, <=0.11.0-beta.3), atomic-server (>=0.32.1, <=0.34.0) +42 more potentially affected by unknown CVE via opentelemetry-jaeger (>=0.1.0, <=0.22.0)

opentelemetry-jaeger CARGO version =0.1.0, =0.2.0, =0.32.1, =0.2.1, =4.1.0, =0.1.0, =0.6.1, =0.4.0-prerelease1, =0.3.2-rc2, =0.2.0-rc-10, =0.2.0-rc-10, =0.2.0-rc-10, =0.2.0-rc, =0.1.0, =0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0123...

BIT-OPENTELEMETRY-COLLECTOR-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

RLSA-2025:15887 Moderate: opentelemetry-collector security update

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry Security Fixes: net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 For more details about the security issues, including the impact, a CVSS score,...

opentelemetry-collector security update

An update is available for opentelemetry-collector. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Collector with the supported components for a Rocky Enterpris...

RockyLinux 9 : opentelemetry-collector (RLSA-2025:15887)

The remote RockyLinux 9 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2025:15887 advisory. net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 Tenable has extracted the preceding description block directly from th...

AlmaLinux 10 : opentelemetry-collector (ALSA-2025:12850)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:12850 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

AlmaLinux 10 : opentelemetry-collector (ALSA-2025:16432)

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2025:16432 advisory. net/http: Sensitive headers not cleared on cross-origin redirect in net/http CVE-2025-4673 Tenable has extracted the preceding description block directly from th...

RockyLinux 10 : opentelemetry-collector (RLSA-2025:12850)

The remote RockyLinux 10 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2025:12850 advisory. net/http: Request smuggling due to acceptance of invalid chunked data in net/http CVE-2025-22871 Tenable has extracted the preceding description block directly...

opentelemetry-collector security update

An update is available for opentelemetry-collector. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Collector with the supported components for a Rocky Enterpris...