RHSA-2026:14162

Vulnerability from csaf_redhat - Published: 2026-05-06 13:54 - Updated: 2026-05-06 16:39
Summary
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release
Severity
Important
Notes
Topic: Red Hat build of OpenTelemetry 3.9.3 has been released
Details: This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878. * Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602. * Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280. * TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU. * IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111. Known issues: * The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2026-4878

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

6.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Vendor Fix For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators https://access.redhat.com/errata/RHSA-2026:14162
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE-2026-29111

A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-1287 - Improper Validation of Specified Type of Input
Vendor Fix For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators https://access.redhat.com/errata/RHSA-2026:14162
Workaround Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE-2026-32280

A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Vendor Fix For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators https://access.redhat.com/errata/RHSA-2026:14162
CVE-2026-32283

A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-764 - Multiple Locks of a Critical Resource
Vendor Fix For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators https://access.redhat.com/errata/RHSA-2026:14162
CVE-2026-41602

A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-190 - Integer Overflow or Wraparound
Vendor Fix For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators https://access.redhat.com/errata/RHSA-2026:14162
References
https://access.redhat.com/errata/RHSA-2026:14162 self
https://access.redhat.com/security/cve/CVE-2026-29111 external
https://access.redhat.com/security/cve/CVE-2026-32280 external
https://access.redhat.com/security/cve/CVE-2026-32283 external
https://access.redhat.com/security/cve/CVE-2026-41602 external
https://access.redhat.com/security/cve/CVE-2026-4878 external
https://access.redhat.com/security/updates/classi… external
https://docs.redhat.com/en/documentation/openshif… external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2026-4878 self
https://bugzilla.redhat.com/show_bug.cgi?id=2451615 external
https://www.cve.org/CVERecord?id=CVE-2026-4878 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4878 external
https://bugzilla.redhat.com/show_bug.cgi?id=2447554 external
https://access.redhat.com/security/cve/CVE-2026-29111 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450505 external
https://www.cve.org/CVERecord?id=CVE-2026-29111 external
https://nvd.nist.gov/vuln/detail/CVE-2026-29111 external
https://github.com/systemd/systemd/commit/1d22f70… external
https://github.com/systemd/systemd/commit/20021e7… external
https://github.com/systemd/systemd/commit/2116700… external
https://github.com/systemd/systemd/commit/3cee294… external
https://github.com/systemd/systemd/commit/42aee39… external
https://github.com/systemd/systemd/commit/54588d2… external
https://github.com/systemd/systemd/commit/7ac3220… external
https://github.com/systemd/systemd/commit/80acea4… external
https://github.com/systemd/systemd/commit/b5fd146… external
https://github.com/systemd/systemd/commit/efa6ba2… external
https://github.com/systemd/systemd/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-32280 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456339 external
https://www.cve.org/CVERecord?id=CVE-2026-32280 external
https://nvd.nist.gov/vuln/detail/CVE-2026-32280 external
https://go.dev/cl/758320 external
https://go.dev/issue/78282 external
https://groups.google.com/g/golang-announce/c/0uY… external
https://pkg.go.dev/vuln/GO-2026-4947 external
https://access.redhat.com/security/cve/CVE-2026-32283 self
https://bugzilla.redhat.com/show_bug.cgi?id=2456338 external
https://www.cve.org/CVERecord?id=CVE-2026-32283 external
https://nvd.nist.gov/vuln/detail/CVE-2026-32283 external
https://go.dev/cl/763767 external
https://go.dev/issue/78334 external
https://pkg.go.dev/vuln/GO-2026-4870 external
https://access.redhat.com/security/cve/CVE-2026-41602 self
https://bugzilla.redhat.com/show_bug.cgi?id=2463407 external
https://www.cve.org/CVERecord?id=CVE-2026-41602 external
https://nvd.nist.gov/vuln/detail/CVE-2026-41602 external
http://www.openwall.com/lists/oss-security/2026/04/28/6 external
https://lists.apache.org/thread/lb4j0zyd5f3g36cos… external
Acknowledgments
Ali Raza
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat build of OpenTelemetry 3.9.3 has been released",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of the Red Hat build of OpenTelemetry provides security improvements.\n\n\nBreaking changes:\n\n* None\n\n\nDeprecations:\n\n* None\n\n\nTechnology Preview features:\n\n* None\n\n\nEnhancements:\n\n* None\n\n\nBug fixes:\n\n* TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878.\n\n* Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602.\n\n* Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280.\n\n* TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU.\n\n* IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111.\n\n\nKnown issues:\n\n* The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:14162",
        "url": "https://access.redhat.com/errata/RHSA-2026:14162"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-29111",
        "url": "https://access.redhat.com/security/cve/CVE-2026-29111"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41602",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41602"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4878",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry",
        "url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_14162.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release",
    "tracking": {
      "current_release_date": "2026-05-06T16:39:16+00:00",
      "generator": {
        "date": "2026-05-06T16:39:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.9"
        }
      },
      "id": "RHSA-2026:14162",
      "initial_release_date": "2026-05-06T13:54:24+00:00",
      "revision_history": [
        {
          "date": "2026-05-06T13:54:24+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-05-06T13:54:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-05-06T16:39:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift distributed tracing 3.9.3",
                "product": {
                  "name": "Red Hat OpenShift distributed tracing 3.9.3",
                  "product_id": "Red Hat OpenShift distributed tracing 3.9.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift distributed tracing"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-operator-bundle@sha256%3A736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778059129"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Aa12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Ac8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Afcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Ac87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3Ad52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3A676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3A265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056267"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056233"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
                  "product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Aa2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt\u0026tag=1778056245"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64 as a component of Red Hat OpenShift distributed tracing 3.9.3",
          "product_id": "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.9.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Ali Raza"
          ]
        }
      ],
      "cve": "CVE-2026-4878",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-03-26T06:56:21.213270+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451615"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451615",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
        }
      ],
      "release_date": "2026-04-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T13:54:24+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14162"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
    },
    {
      "cve": "CVE-2026-29111",
      "cwe": {
        "id": "CWE-1287",
        "name": "Improper Validation of Specified Type of Input"
      },
      "discovery_date": "2026-03-23T22:01:54.593547+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450505"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450505",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
          "url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
          "url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
          "url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
          "url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
          "url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
          "url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
          "url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
          "url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
          "url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
          "url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
        },
        {
          "category": "external",
          "summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
          "url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
        }
      ],
      "release_date": "2026-03-23T21:03:56.120000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T13:54:24+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14162"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
    },
    {
      "cve": "CVE-2026-32280",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-04-08T02:01:19.572351+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456339"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456339",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/758320",
          "url": "https://go.dev/cl/758320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78282",
          "url": "https://go.dev/issue/78282"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4947",
          "url": "https://pkg.go.dev/vuln/GO-2026-4947"
        }
      ],
      "release_date": "2026-04-08T01:06:58.595000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T13:54:24+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14162"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
    },
    {
      "cve": "CVE-2026-32283",
      "cwe": {
        "id": "CWE-764",
        "name": "Multiple Locks of a Critical Resource"
      },
      "discovery_date": "2026-04-08T02:01:16.213799+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763767",
          "url": "https://go.dev/cl/763767"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78334",
          "url": "https://go.dev/issue/78334"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4870",
          "url": "https://pkg.go.dev/vuln/GO-2026-4870"
        }
      ],
      "release_date": "2026-04-08T01:06:57.670000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T13:54:24+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14162"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "cve": "CVE-2026-41602",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-28T10:01:16.099816+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463407"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
          "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41602"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463407",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41602",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41602"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/28/6",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/28/6"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
          "url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
        }
      ],
      "release_date": "2026-04-28T09:19:06.646000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-05-06T13:54:24+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:14162"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:265d8d864589e9ca6739e5eff46be545dc531aa6aa72378674b3ae9ff48f14ac_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:3485dd7a7615da6e658547c117818f41c855aa8fcff80b609e56afec46e00546_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:36790acac3369dd38803aca4433376edfa9edc8785ea0b61ec95b931effddf00_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:5adac8b8aa26beaa38c4a0d20f0271890c0fbaf06b9bcbc7c00a3e27cd1a4c5b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:736f03edb0dfea64fcb9a723dc8a01d8ffd4f2c5b952b3a8f1b2ab6b7320af4b_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:109f44564a590b7dbdf7337f93a5297875f58e2810123a134a5386a5ba8bd62b_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:a12ee44613f8bb32f083f719b08af74a8e72815ab35156cb23242f2889745865_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:d52121422c85bc4b79590e67bf047d90b50b763425fcf5676265f65eb3faa1e2_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:fcd49001027e05749fd68dadc316af46bd7d49931821950cbeb037c7d19f7d66_arm64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:676693e80ea746f3e6382a0cd81b21c77c3922cafa74ec3a349b89943d59f2ee_ppc64le",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a2d150f31c8e11e4d0cc651d8a58212f769d00b453e6a7efcc68ca5cca63878d_s390x",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c8348d21a8cecefea08d43a4bcd4898bc086ce91ccd60a2e9c31bbb13e5511c7_amd64",
            "Red Hat OpenShift distributed tracing 3.9.3:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:c87072639a6a332398c6681de4f18578c4778f33117e25be63fca278bb94ab2b_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.