Security
فارسی
All products

Red Hat OpenShift distributed tracing 3/rhosdt/tempo-query-rhel9

Red Hat · Package
14 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compressCVE-2026-63209 · GHSA-259R-337F-4RFWVersion ranges need review. github.com/klauspost/compressFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle GoRed Hat High Fix reported
HTTP/2 transport accepts malformed framing-related headers in net/httpCVE-2026-78660 · GO-2026-6610 golang.org/x/netstdlib GoRed Hat Medium Fix reported
OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullCVE-2026-81872 · GHSA-HJF4-FPHR-2H65Version ranges need review. go.opentelemetry.io/otel/sdk/logAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat Medium Fix reported
OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinningCVE-2026-81871 · GHSA-W34Q-CM8F-9C5XVersion ranges need review. go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpcAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat Medium Fix reported
Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/htmlCVE-2026-25681 · GO-2026-5029 golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat High Fix reported
Invoking duplicate attributes can cause XSS in golang.org/x/net/htmlCVE-2026-27136 · GO-2026-5030 golang.org/x/netAssisted Installer for Red Hat OpenShift Container Platform 2/assisted/agent-preinstall-image-builder-rhel9 GoRed Hat High Fix reported
Denial of Service due to Panic in AWS SDK for Go v2 SDK EventStream DecoderCVE-2026-89090 · GHSA-XMRV-PMRH-HHX2Version ranges need review. github.com/aws/aws-sdk-go-v2/aws/protocol/eventstreamgithub.com/aws/aws-sdk-go-v2/service/bedrockagentcore GoRed Hat Medium Fix reported
XPath: Boolean expression infinite loop leads to denial of service via CPU exhaustionCVE-2026-32287 · GHSA-65XW-VW82-R86XVersion ranges need review. github.com/antchfx/xpathCompliance Operator/compliance/openshift-compliance-operator-bundle GoRed Hat High Fix reported
Prometheus Azure AD remote write OAuth client secret exposed via config APICVE-2026-42151 · GHSA-WG65-39GG-5WFJVersion ranges need review. github.com/prometheus/prometheusFile Integrity Operator/compliance/openshift-file-integrity-operator-bundle GoRed Hat High Fix reported
Apache Thrift has an Improper Validation of Certificate with Host Mismatch VulnerabilityCVE-2026-43869 · GHSA-7PWC-H2J2-RJGJ org.apache.thrift:libthriftMulticluster Global Hub/multicluster-globalhub/multicluster-globalhub-grafana-rhel8 MavenRed Hat High Fix reported
Apache Thrift vulnerable to Path Traversal, HTTP Request/Response Splitting, Uncontrolled Resource ConsumptionCVE-2026-43870 · GHSA-526F-JXPJ-JMG2 thriftRed Hat Advanced Cluster Management for Kubernetes 2/redhat-user-workloads/grafana-acm-213 npmRed Hat High No fix reported
Apache Thrift Node.js bindings vulnerable to Uncontrolled RecursionCVE-2026-41636 · GHSA-R67J-R569-JRWP thriftRed Hat AI Inference Server/rhaiis/vllm-cpu-rhel9 npmRed Hat High Fix reported
Apache Thrift: c_glib: Apache Thrift c_glib: Denial of Service via specially crafted requestsCVE-2025-48431 Red Hat AI Inference Server/rhaiis/vllm-cpu-rhel9Red Hat AI Inference Server/rhaiis/vllm-tpu-rhel9 Red Hat High No fix reported
github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validationCVE-2026-81092 Red Hat Connectivity Link 1/rhcl-tech-preview/mcp-gateway-rhel9-operatorRed Hat Connectivity Link 1/rhcl-tech-preview/mcp-gateway-rhel9 Red Hat Medium No fix reported