{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 has been released",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes.\n\n\nBreaking changes:\n\n* High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169.\n\n\nDeprecations:\n\n* Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509.\n\n\nTechnology Preview features:\n\n* None\n\n\nEnhancements:\n\n* High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168.\n\n* Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485.\n\n\nBug fixes:\n\n* TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453.\n\n* Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435.\n\n* Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646.\n\n\nKnown issues:\n\n* None",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:65343",
        "url": "https://access.redhat.com/errata/RHSA-2026:65343"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-33818",
        "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-41178",
        "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-42502",
        "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48586",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48586"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-55969",
        "url": "https://access.redhat.com/security/cve/CVE-2026-55969"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56853",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56858",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56859",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56860",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56862",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo",
        "url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65343.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release",
    "tracking": {
      "current_release_date": "2026-09-14T00:52:12+00:00",
      "generator": {
        "date": "2026-09-14T00:52:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.21"
        }
      },
      "id": "RHSA-2026:65343",
      "initial_release_date": "2026-09-08T10:30:06+00:00",
      "revision_history": [
        {
          "date": "2026-09-08T10:30:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-09-08T10:30:36+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-09-14T00:52:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift distributed tracing 3.11.1",
                "product": {
                  "name": "Red Hat OpenShift distributed tracing 3.11.1",
                  "product_id": "Red Hat OpenShift distributed tracing 3.11.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.11::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift distributed tracing"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-operator-bundle@sha256%3A4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/tempo-operator-bundle\u0026tag=1788359217"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-rhel9\u0026tag=1788356414"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3Ac1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9\u0026tag=1788356441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9\u0026tag=1788356443"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3Ace8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9-operator\u0026tag=1788355183"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3Ad477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/tempo-query-rhel9\u0026tag=1788356448"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3A715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9\u0026tag=1788356473"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-rhel9\u0026tag=1788356414"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9\u0026tag=1788356441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9\u0026tag=1788356443"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3A38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9-operator\u0026tag=1788355183"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3Ac9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/tempo-query-rhel9\u0026tag=1788356448"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3Adb7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9\u0026tag=1788356473"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-rhel9\u0026tag=1788356414"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3A296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9\u0026tag=1788356441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9\u0026tag=1788356443"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3Afc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9-operator\u0026tag=1788355183"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3A0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/tempo-query-rhel9\u0026tag=1788356448"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3Afa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9\u0026tag=1788356473"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-rhel9@sha256%3A00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-rhel9\u0026tag=1788356414"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-jaeger-query-rhel9@sha256%3Aaaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9\u0026tag=1788356441"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-gateway-opa-rhel9@sha256%3A55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9\u0026tag=1788356443"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9-operator@sha256%3Abc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9-operator\u0026tag=1788355183"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-query-rhel9@sha256%3Ac91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/tempo-query-rhel9\u0026tag=1788356448"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
                "product": {
                  "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
                  "product_id": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
                  "product_identification_helper": {
                    "purl": "pkg:oci/tempo-rhel9@sha256%3Abc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/tempo-rhel9\u0026tag=1788356473"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.1",
          "product_id": "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        },
        "product_reference": "registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le",
        "relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-32283",
      "cwe": {
        "id": "CWE-764",
        "name": "Multiple Locks of a Critical Resource"
      },
      "discovery_date": "2026-04-08T02:01:16.213799+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2456338"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "RHBZ#2456338",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/763767",
          "url": "https://go.dev/cl/763767"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/78334",
          "url": "https://go.dev/issue/78334"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
          "url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-4870",
          "url": "https://pkg.go.dev/vuln/GO-2026-4870"
        }
      ],
      "release_date": "2026-04-08T01:06:57.670000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
    },
    {
      "cve": "CVE-2026-33818",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:12:37.151735+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/asn1` package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One (ASN.1) structure, leading to excessive recursion during the `Unmarshal` operation. This could result in stack exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go encoding/asn1 package, as it can be triggered remotely without authentication. An attacker can provide a malformed ASN.1 structure, causing excessive recursion during unmarshalling and leading to stack exhaustion, which can render the service unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-33818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33818"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/814980",
          "url": "https://go.dev/cl/814980"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80405",
          "url": "https://go.dev/issue/80405"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5972",
          "url": "https://pkg.go.dev/vuln/GO-2026-5972"
        }
      ],
      "release_date": "2026-08-13T21:58:52.821000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal"
    },
    {
      "cve": "CVE-2026-41178",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-04T16:01:10.300537+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2484830"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in OpenTelemetry-Go, affecting versions 1.41.0 and 1.43.0. An attacker can exploit this flaw by sending oversized baggage headers, causing the `Parse` function to process invalid inputs and log errors, which can lead to resource exhaustion and service disruption in Red Hat products utilizing these affected OpenTelemetry-Go versions. The impact is considered Important due to the potential for remote, unauthenticated denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "RHBZ#2484830",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484830"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-41178",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41178"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/pull/7880",
          "url": "https://github.com/open-telemetry/opentelemetry-go/pull/7880"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835",
          "url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835"
        }
      ],
      "release_date": "2026-06-04T14:38:23.707000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/open-telemetry/opentelemetry-go: go.opentelemetry.io/otel/baggage: go.opentelemetry.io/otel/propagation: OpenTelemetry-Go: Denial of Service via oversized baggage headers"
    },
    {
      "cve": "CVE-2026-42502",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-05-22T16:01:11.151484+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2480762"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/net/html. This vulnerability allows an attacker to manipulate how HTML is processed and displayed. By providing specially crafted HTML, an attacker can cause an unexpected structure in the rendered output. This can lead to Cross-Site Scripting (XSS) attacks, where malicious scripts are executed in a user\u0027s web browser, potentially compromising user data or taking control of their session.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in golang.org/x/net/html can lead to Cross-Site Scripting (XSS) in applications that parse and render untrusted HTML, even with sanitization attempts. This is due to an unexpected HTML tree structure, allowing malicious scripts to execute in a user\u0027s browser.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "RHBZ#2480762",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480762"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-42502",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42502"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/781701",
          "url": "https://go.dev/cl/781701"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/79572",
          "url": "https://go.dev/issue/79572"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8",
          "url": "https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5027",
          "url": "https://pkg.go.dev/vuln/GO-2026-5027"
        }
      ],
      "release_date": "2026-05-22T15:01:21.649000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        },
        {
          "category": "workaround",
          "details": "Applications utilizing `golang.org/x/net/html` should implement robust sanitization of all untrusted HTML input before rendering to prevent the creation of unexpected HTML structures that could facilitate XSS attacks. If an application does not require rendering arbitrary HTML, it should avoid processing such input.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via unexpected HTML tree rendering"
    },
    {
      "cve": "CVE-2026-48586",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-07-27T12:01:11.736259+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507434"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important vulnerability in Apache Thrift\u0027s handling of highly compressed data can lead to a denial of service. Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507434",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507434"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48586",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/07/24/37",
          "url": "http://www.openwall.com/lists/oss-security/2026/07/24/37"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
          "url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq",
          "url": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq"
        }
      ],
      "release_date": "2026-07-27T11:02:54.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data"
    },
    {
      "cve": "CVE-2026-55969",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-07-27T12:01:08.265881+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2507433"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Apache Thrift\u0027s C++, c_glib, Go, netstd, Delphi, and Haxe bindings. This integer overflow or wraparound vulnerability allows a remote attacker to cause a denial of service (DoS) by sending specially crafted input. The flaw can lead to the affected service becoming unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in Apache Thrift bindings, rated as Important, allows a remote attacker to trigger a denial of service. The integer overflow or wraparound flaw can lead to affected services becoming unavailable, impacting the reliability of systems utilizing vulnerable Thrift components across Red Hat products such as OpenShift Container Platform and Red Hat Ceph Storage.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-55969"
        },
        {
          "category": "external",
          "summary": "RHBZ#2507433",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507433"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-55969",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-55969"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55969",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55969"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/07/24/40",
          "url": "http://www.openwall.com/lists/oss-security/2026/07/24/40"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
          "url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
        },
        {
          "category": "external",
          "summary": "https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo",
          "url": "https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo"
        }
      ],
      "release_date": "2026-07-27T11:07:53.785000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-56853",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:14:53.561638+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515827"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `net/http` component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the `ReadHeaderTimeout` is not correctly applied during this process. This oversight could allow a remote attacker to maintain open connections indefinitely, potentially leading to a Denial of Service (DoS) by exhausting server resources.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: Unencrypted HTTP/2 servers are susceptible to a denial of service due to improper handling of ReadHeaderTimeout during the client preface reading phase. This can lead to resource exhaustion and service unavailability in affected Red Hat products configured to support unencrypted HTTP/2.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515827",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515827"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56853",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56853"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/795540",
          "url": "https://go.dev/cl/795540"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80205",
          "url": "https://go.dev/issue/80205"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6089",
          "url": "https://pkg.go.dev/vuln/GO-2026-6089"
        }
      ],
      "release_date": "2026-08-13T21:58:53.092000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service"
    },
    {
      "cve": "CVE-2026-56858",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:32.034590+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515838"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `html/template` component of Go (golang). Pathological inputs could prematurely close an unescaped forward slash (\u0027/\u0027), allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting (XSS), where malicious scripts are executed in a user\u0027s browser, potentially compromising user data or actions.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important cross-site scripting (XSS) vulnerability in the Go `html/template` package. Applications utilizing this package to render untrusted input are susceptible to arbitrary content injection due to a flaw in how pathological inputs are handled, potentially leading to client-side script execution.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515838",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515838"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56858",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56858"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/807100",
          "url": "https://go.dev/cl/807100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80435",
          "url": "https://go.dev/issue/80435"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6091",
          "url": "https://pkg.go.dev/vuln/GO-2026-6091"
        }
      ],
      "release_date": "2026-08-13T21:58:53.354000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input"
    },
    {
      "cve": "CVE-2026-56859",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-08-13T22:16:52.493058+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `encoding/xml` package of Go. The `DecodeElement` function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service (DoS) for the affected application.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "An Important denial of service flaw affects applications utilizing the Go `encoding/xml` package. This vulnerability arises from an issue in XML decoding where a recursion depth counter fails to reset, potentially leading to stack exhaustion when processing malicious XML input.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56859",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56859"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803320",
          "url": "https://go.dev/cl/803320"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80481",
          "url": "https://go.dev/issue/80481"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6088",
          "url": "https://pkg.go.dev/vuln/GO-2026-6088"
        }
      ],
      "release_date": "2026-08-13T21:58:52.959000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue"
    },
    {
      "cve": "CVE-2026-56860",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-08-13T22:13:18.319384+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515820"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in `net/url`, a component of `golang`. This vulnerability arises when resolving relative paths that contain numerous parent directory (\u0027..\u0027) segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory allocation. This can result in a Denial of Service (DoS) due to resource exhaustion.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in the Go `net/url` package. Applications built with Go that process untrusted URLs containing parent directory segments (\u0027..\u0027) may be vulnerable to excessive resource consumption due to quadratic time complexity in path resolution. This can lead to a denial of service, impacting the availability of affected services.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515820",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515820"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56860",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56860"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/803681",
          "url": "https://go.dev/cl/803681"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80494",
          "url": "https://go.dev/issue/80494"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6218",
          "url": "https://pkg.go.dev/vuln/GO-2026-6218"
        }
      ],
      "release_date": "2026-08-13T21:58:53.731000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution"
    },
    {
      "cve": "CVE-2026-56862",
      "cwe": {
        "id": "CWE-1050",
        "name": "Excessive Platform Resource Consumption within a Loop"
      },
      "discovery_date": "2026-08-13T22:16:41.928450+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2515839"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the `crypto/tls` package, part of `golang`. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service vulnerability in the `golang` `crypto/tls` package. A remote, unauthenticated attacker can exploit this flaw by continuously sending `KeyUpdate` messages during a TLS handshake, forcing the server to perform indefinite key derivation operations. This resource exhaustion can lead to a denial of service for applications and services in Red Hat products that use the affected `crypto/tls` library and are exposed to untrusted network clients.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
        ],
        "known_not_affected": [
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
          "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "RHBZ#2515839",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2515839"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56862"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/804261",
          "url": "https://go.dev/cl/804261"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80528",
          "url": "https://go.dev/issue/80528"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/g/golang-announce/c/94pEornpRlI",
          "url": "https://groups.google.com/g/golang-announce/c/94pEornpRlI"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-6090",
          "url": "https://pkg.go.dev/vuln/GO-2026-6090"
        }
      ],
      "release_date": "2026-08-13T21:58:53.216000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-08T10:30:06+00:00",
          "details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
          "product_ids": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:65343"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:3dc8064a3c9df9bcededaa9e07928243c89c4a5e1957aa1ccef5830372f12def_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:4f8bce8339b7f56fd235e55d174ab6ddffe7faaea218dbe68dffc8ad2b52c7d5_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:55a6f2354f3a0c28d9fa71aa05a33a3f03cc9106a20dba685fc47910b476390e_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:8e43065b85f59d4511330d4bbd44d41a198768dc1d805b4dbb20e2a96793541f_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:00bf63fd5ff8b0b054634861f4b443d3c5d41606def6d6472b34c1b2fe1c23ef_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:34443daf80df70881343176abfa2d39a0e3e405f496538eb615d1318c28d21a9_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:43db927dc3b1c5f63b07e605e55514b352422fe48e8e41befcbb65ba001446e7_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:6f074646be173e3aee7855a72c5a8e51b305973a7b77df1b1c8099a8c27d54f7_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:169957c61edea0e7f2514d2d666830aa08721f5498a7740bd212c00bacef492b_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:296dc5257dbceb8b0eada13964e2d0a4e3ba7d57c275819bb0c7845955f9dcce_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:aaf153c236bd868a88eb7996e0cf393a00186b789b3ea0a338e4adc6a7a8b550_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:c1ea018ea61723ed980030568929e19650597a5e2f551666b801d22ca3165e19_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:4ae2a2bd47e0e8ddbdab9651326df3a903d5df4205731e603302c52fecbce408_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0d286912daf27a243297b4710042f23aa6003c568bc5e180323f7c070b098936_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c91bddedae305f0c85da7310e033047a347c7fe10ac556b68a6a48aad03ff5b3_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:c9d8d89c5cc54a1eabe9836e885c5f97c950b14dd2dd1c94a8c975f814858b0a_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:d477a7ec505b29bf86860c3d3ad3787b7be84e4634e4f6c4c9b2fcfd75037eb8_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:38704b064c8f6d71974d9080b93a6c6c9390ad5fdfd200cce77f0e777a536e71_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:bc49d34d7b298412e974d16169b9483fda678dd9c7d0ea149c46dcb1b126865b_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:ce8d9e3d064ca63628fe1addbca3b098687b767a7829c948f360f738e01056a5_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fc2617928b38e2f8bc252838af01dc6cf68a0d9a39bc94f0b96e9ac5a80e042a_ppc64le",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:715cbe4ceee09c038a3882bf4ad7aa17f04c8c971e4fe49bc71731c531ba83ef_amd64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:bc3babeed69fcaa182e45bad664c9df15933ceb44122ccd5cca6b5dce6e423d1_s390x",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:db7593ef37b8d7dabbdad4631d1dd49ef82ad8ccf44edd1a78d2f47e221335bf_arm64",
            "Red Hat OpenShift distributed tracing 3.11.1:registry.redhat.io/rhosdt/tempo-rhel9@sha256:fa340890422052956c762adbfa853fb96fa71b198eee6994cda4f50f0b0f52ba_ppc64le"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages"
    }
  ]
}