RHSA-2026:65542
Vulnerability from csaf_redhat - Published: 2026-09-08 16:27 - Updated: 2026-09-08 22:50Summary
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.11.0 release
Severity
Important
Notes
Topic: Red Hat build of OpenTelemetry 3.11.0 has been released
Details: This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.
Breaking changes:
* With this update, the `add_metric_suffixes` field of the Prometheus Exporter configuration in the `OpenTelemetryCollector` custom resource is removed. To manage metric name suffixes, use the `translation_strategy` field instead.
Deprecations:
* Google Cloud Exporter is deprecated: The Google Cloud Exporter, which sends telemetry data to Google Cloud Operations Suite, is deprecated and will be removed in a future major release. You can export data to Google Cloud Operations Suite by using the OTLP HTTP Exporter with the Google Client Authorization Extension instead. For more information, see https://redhat.atlassian.net/browse/TRACING-6139.
Technology Preview features:
* OBI (Open Telemetry eBPF) Receiver: This update adds the OBI (Open Telemetry eBPF) Receiver to the Red Hat build of OpenTelemetry as a Technology Preview feature. The OBI Receiver uses eBPF to automatically inspect application executables and the OS networking layer, and capture trace spans, Rate Errors Duration (RED) metrics.
* Redaction Processor: This update adds the Redaction Processor to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Redaction Processor removes sensitive data from telemetry data before it is exported. For more information, see https://redhat.atlassian.net/browse/TRACING-6502.
* Headers Setter Extension: This update adds the Headers Setter Extension to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Headers Setter Extension sets headers on outgoing HTTP requests made by exporters. For more information, see https://redhat.atlassian.net/browse/TRACING-6504.
* Kubernetes Leader Elector Extension: This update adds the Kubernetes Leader Elector Extension to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Kubernetes Leader Elector Extension enables OpenTelemetry components to run in HA mode across a Kubernetes cluster. The component that owns the lease becomes the leader and becomes the active instance. For more information, see https://redhat.atlassian.net/browse/TRACING-6478.
Enhancements:
* High availability for the Operator webhooks: This update introduces high availability support for the Red Hat build of OpenTelemetry Operator webhooks. The webhooks run in a separate deployment from the main Operator deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6157.
Bug fixes:
* Instrumentation CR status fields are updated automatically: Before this update, when creating or updating an Instrumentation custom resource (CR), the .status.observedGeneration and .status.conditions fields were not updated because the Red Hat build of OpenTelemetry Operator lacked a reconciliation controller for Instrumentation CRs. In this release, the Operator continuously reconciles Instrumentation CRs and populates these status fields upon creation or update without requiring an Operator restart. For more information, see https://issues.redhat.com/browse/TRACING-6412.
* Automatic RBAC of the Operator includes PersistentVolume and PersistentVolumeClaim resources: Before this update, the automatic Role-Based Access Control (RBAC) feature of the Red Hat build of OpenTelemetry Operator did not include the required permissions for PersistentVolume and PersistentVolumeClaim resources. As a consequence, the Kubernetes Cluster Receiver failed with RBAC errors. With this update, the Operator automatically grants the required permissions for these resources. As a result, the Kubernetes Cluster Receiver works correctly with the automatic RBAC feature. For more information, see https://redhat.atlassian.net/browse/TRACING-6381.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64 | — |
Vendor Fix
fix
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x | — | ||
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le | — |
Threats
Impact
Important
A flaw was found in Apache Thrift's C++, c_glib, Go, netstd, Delphi, and Haxe bindings. This integer overflow or wraparound vulnerability allows a remote attacker to cause a denial of service (DoS) by sending specially crafted input. The flaw can lead to the affected service becoming unavailable.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le | — |
Workaround
|
Threats
Impact
Important
References
19 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat build of OpenTelemetry 3.11.0 has been released",
"title": "Topic"
},
{
"category": "general",
"text": "This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.\n\n\nBreaking changes:\n\n* With this update, the `add_metric_suffixes` field of the Prometheus Exporter configuration in the `OpenTelemetryCollector` custom resource is removed. To manage metric name suffixes, use the `translation_strategy` field instead.\n\nDeprecations:\n\n* Google Cloud Exporter is deprecated: The Google Cloud Exporter, which sends telemetry data to Google Cloud Operations Suite, is deprecated and will be removed in a future major release. You can export data to Google Cloud Operations Suite by using the OTLP HTTP Exporter with the Google Client Authorization Extension instead. For more information, see https://redhat.atlassian.net/browse/TRACING-6139.\n\n\nTechnology Preview features:\n\n* OBI (Open Telemetry eBPF) Receiver: This update adds the OBI (Open Telemetry eBPF) Receiver to the Red Hat build of OpenTelemetry as a Technology Preview feature. The OBI Receiver uses eBPF to automatically inspect application executables and the OS networking layer, and capture trace spans, Rate Errors Duration (RED) metrics.\n\n* Redaction Processor: This update adds the Redaction Processor to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Redaction Processor removes sensitive data from telemetry data before it is exported. For more information, see https://redhat.atlassian.net/browse/TRACING-6502.\n\n* Headers Setter Extension: This update adds the Headers Setter Extension to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Headers Setter Extension sets headers on outgoing HTTP requests made by exporters. For more information, see https://redhat.atlassian.net/browse/TRACING-6504.\n\n* Kubernetes Leader Elector Extension: This update adds the Kubernetes Leader Elector Extension to the Red Hat build of OpenTelemetry as a Technology Preview feature. The Kubernetes Leader Elector Extension enables OpenTelemetry components to run in HA mode across a Kubernetes cluster. The component that owns the lease becomes the leader and becomes the active instance. For more information, see https://redhat.atlassian.net/browse/TRACING-6478.\n\n\nEnhancements:\n\n* High availability for the Operator webhooks: This update introduces high availability support for the Red Hat build of OpenTelemetry Operator webhooks. The webhooks run in a separate deployment from the main Operator deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6157.\n\n\nBug fixes:\n* Instrumentation CR status fields are updated automatically: Before this update, when creating or updating an Instrumentation custom resource (CR), the .status.observedGeneration and .status.conditions fields were not updated because the Red Hat build of OpenTelemetry Operator lacked a reconciliation controller for Instrumentation CRs. In this release, the Operator continuously reconciles Instrumentation CRs and populates these status fields upon creation or update without requiring an Operator restart. For more information, see https://issues.redhat.com/browse/TRACING-6412.\n\n* Automatic RBAC of the Operator includes PersistentVolume and PersistentVolumeClaim resources: Before this update, the automatic Role-Based Access Control (RBAC) feature of the Red Hat build of OpenTelemetry Operator did not include the required permissions for PersistentVolume and PersistentVolumeClaim resources. As a consequence, the Kubernetes Cluster Receiver failed with RBAC errors. With this update, the Operator automatically grants the required permissions for these resources. As a result, the Kubernetes Cluster Receiver works correctly with the automatic RBAC feature. For more information, see https://redhat.atlassian.net/browse/TRACING-6381.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:65542",
"url": "https://access.redhat.com/errata/RHSA-2026:65542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48586",
"url": "https://access.redhat.com/security/cve/CVE-2026-48586"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55969",
"url": "https://access.redhat.com/security/cve/CVE-2026-55969"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/red_hat_build_of_opentelemetry"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65542.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.11.0 release",
"tracking": {
"current_release_date": "2026-09-08T22:50:09+00:00",
"generator": {
"date": "2026-09-08T22:50:09+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.17"
}
},
"id": "RHSA-2026:65542",
"initial_release_date": "2026-09-08T16:27:25+00:00",
"revision_history": [
{
"date": "2026-09-08T16:27:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-08T16:27:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-08T22:50:09+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift distributed tracing 3.11.0",
"product": {
"name": "Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_distributed_tracing:3.11::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift distributed tracing"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-operator-bundle@sha256%3Ab760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-operator-bundle\u0026tag=1787668434"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3Ac978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1787661228"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1787654791"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3A44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8?arch=amd64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1787654760"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3Af44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1787661228"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1787654791"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Aa7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863?arch=arm64\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1787654760"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3Abe10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1787661228"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1787654791"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Abcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19?arch=ppc64le\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1787654760"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-collector-rhel9@sha256%3Ac16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-collector-rhel9\u0026tag=1787661228"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-rhel9-operator@sha256%3A8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-rhel9-operator\u0026tag=1787654791"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"product": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"product_id": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opentelemetry-target-allocator-rhel9@sha256%3Aad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2?arch=s390x\u0026repository_url=registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9\u0026tag=1787654760"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.0",
"product_id": "Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
},
"product_reference": "registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift distributed tracing 3.11.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-48586",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-07-27T12:01:11.736259+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507434"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Apache Thrift\u0027s handling of highly compressed data can lead to a denial of service. Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48586"
},
{
"category": "external",
"summary": "RHBZ#2507434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507434"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48586",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48586"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48586"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/24/37",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/37"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq",
"url": "https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq"
}
],
"release_date": "2026-07-27T11:02:54.430000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-08T16:27:25+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:65542"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: org.apache.thrift/libthrift: github.com/apache/thrift: Apache Thrift: Denial of Service via improper handling of highly compressed data"
},
{
"cve": "CVE-2026-55969",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-07-27T12:01:08.265881+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2507433"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift\u0027s C++, c_glib, Go, netstd, Delphi, and Haxe bindings. This integer overflow or wraparound vulnerability allows a remote attacker to cause a denial of service (DoS) by sending specially crafted input. The flaw can lead to the affected service becoming unavailable.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability in Apache Thrift bindings, rated as Important, allows a remote attacker to trigger a denial of service. The integer overflow or wraparound flaw can lead to affected services becoming unavailable, impacting the reliability of systems utilizing vulnerable Thrift components across Red Hat products such as OpenShift Container Platform and Red Hat Ceph Storage.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64"
],
"known_not_affected": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55969"
},
{
"category": "external",
"summary": "RHBZ#2507433",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507433"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55969",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55969"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55969",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55969"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/07/24/40",
"url": "http://www.openwall.com/lists/oss-security/2026/07/24/40"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9",
"url": "https://lists.apache.org/thread/7v3jhgwfbmhx42424phydlnzb109g8b9"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo",
"url": "https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo"
}
],
"release_date": "2026-07-27T11:07:53.785000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-08T16:27:25+00:00",
"details": "For details on how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/operators/administrator-tasks#olm-upgrading-operators",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:65542"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:be10082c2fa3d382f9f3f6e9965a5671eb857219506cbe28a84e250abd513289_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c16f2b226c6fa1df2b0c45271f7429afe5bfb9abeba4c9986a5f10c0ececc0a2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:c978aa771ee250022ba72dd67db6ed63613f17f717bc1c07d107a5982d9e3160_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-collector-rhel9@sha256:f44b6f7bd152dbfcfb4f1c067472464d013be031985b8e30370c925abde0c8ec_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:b760df73ba4b903adfc466b427453907850b88a43c7d77c2aadec9d880577243_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:12f2ad8c82a43430eba0caa78fa3c95d7e31d2355d33869e3a470c1fd03901ae_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:3b4357f29551c2e1defbc9fe6d419323339effe87e4e7363e6c7ce7ddb373d3f_ppc64le",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:8a8032c902dc640147300c7ba90c5c34d48c5dba640f501248f87fee8b1928b5_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-rhel9-operator@sha256:90c3079709e4ca7b69b9f4014cb76c18d0302c5957bb162d34d6dbd35a121cac_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:44df27737d7965f37444baa1dd4bb5f971c0ee4f18709b266184b39081b648c8_amd64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:a7a816f6276bcbaa5b01a8c634feaf37adffb941d48be747fbb7aca3c080b863_arm64",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:ad9ca1e9011c15176fc2455ddfa0d3fc8f7cdd35161a0ad784371d4cf26d59c2_s390x",
"Red Hat OpenShift distributed tracing 3.11.0:registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9@sha256:bcbb3cc8a5b081b9afecebdc973cfd8fb78aa7300e20149b59ce28088f1f5a19_ppc64le"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…