Affected: Grafana Tempo, Grafana Enterprise Traces (GET), Red Hat Multicluster Global Hub 1.3.4, Red Hat Multicluster Global Hub 1.4.5, Red Hat Multicluster Global Hub 1.6.5, Red Hat Multicluster Global Hub 1.7.0, Red Hat multicluster global hub 1.5.3, Red Hat Logging Subsystem for Red Hat OpenShift, Red Hat Multicluster Global Hub, Red Hat Advanced Cluster Management for Kubernetes 2 and 6 more

Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy.

Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Alternatively, automatically restart the service.

Affected: Go: github.com/google/cel-go

The function `ext.NativeTypes(ParseStructTag("json"))` does not honour the `encoding/json` skip directive `json:"-"`. Fields tagged `json:"-"` are registered in the CEL type system under the literal name `"-"` and are readable from any user-submitted CEL expression via `dyn(obj)["-"]`.

Additionally, `newNativeTypes` silently registers every nested struct reachable from the type passed to `NativeTypes`, including types from third-party dependencies the developer never examined.

## Root cause

In `fieldNameByTag`, the helper used by `ParseStructTag("json")` to translate Go struct tags into CEL field names.

See at `ext/native.go:146`:

```go func fieldNameByTag(structTagToParse string) func(field reflect.StructField) string { return func(field reflect.StructField) string { tag, found := field.Tag.Lookup(structTagToParse) if found { splits := strings.Split(tag, ",") if len(splits) > 0 { // We make the assumption that the leftmost entry in the tag is the name. // This seems to be true for most tags that have the concept of a name/key, such as: // https://pkg.go.dev/encoding/xml#Marshal // https://pkg.go.dev/encoding/json#Marshal // https://pkg.go.dev/go.mongodb.org/mongo-driver/bson#hdr-Structs // https://pkg.go.dev/go.yaml.in/yaml/v3#Marshal name := splits[0] return name } }

re…