TI-2025-21540 CVE-2025-30204 · GHSA-mh63-6h87-95cp
jwt-go allows excessive memory allocation during header parsing
Priority MEDIUM 40
golang-jwt is a Go implementation of JSON Web Tokens.
RHSA-2025:3740
Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release
Released 2025-04-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift distributed tracing 3.5.3 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel8, registry.redhat.io/rhosdt/tempo-gateway-rhel8, registry.redhat.io/rhosdt/tempo-rhel8 +1
Fixes 5 records
TI-2025-21197 CVE-2025-29786 · GHSA-93mq-9ffx-83m2
Memory Exhaustion in Expr Parser with Unrestricted Input
Priority MEDIUM 40
Expr is an expression language and expression evaluation for Go.
TI-2025-16740 CVE-2025-22868 · GHSA-6v2p-p543-phr9
Unexpected memory consumption during token parsing in golang.org/x/oauth2
Priority MEDIUM 40
An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
TI-2025-02482 CVE-2025-2842 · GHSA-5xf3-gmx4-529v
Tempo-operator: tempo operator token exposition lead to read sensitive data
Priority LOW 20
A flaw was found in the Tempo Operator.
TI-2025-02435 CVE-2025-2786 · GHSA-28gr-56hr-prp6
Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operator
Priority LOW 20
A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance.