Red Hat Security Advisory

RHSA-2026:14885

Red Hat OpenShift distributed tracing platform (Tempo) 3.9.3 release

Released 2026-05-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift distributed tracing 3.9.3 registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9, registry.redhat.io/rhosdt/tempo-query-rhel9, registry.redhat.io/rhosdt/tempo-rhel9

Fixes 5 records

TI-2026-30145 CVE-2026-41604 · GHSA-r4rx-ffxv-23vw

Apache Thrift: Swift Range crash in skip()

MEDIUM 43

Out-of-bounds Read vulnerability in Apache Thrift.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00918 Published 2026-04-28 Partial fix · 0.23.0 CWE-125

TI-2026-30144 CVE-2026-41602 · GHSA-wf45-q9ch-q8gh

Apache Thrift: Go TFramedTransport uint32 overflow

MEDIUM 41

Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01163 Published 2026-04-28 Partial fix · 0.23.0 CWE-190

TI-2026-30146 CVE-2026-41605 · GHSA-qcp3-xfwx-5hr4

Apache Thrift: Swift Compact Protocol integer overflow

MEDIUM 40

Integer Overflow or Wraparound vulnerability in Apache Thrift.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.0093 Published 2026-04-28 Partial fix · 0.23.0 CWE-190

TI-2026-30148 CVE-2026-41607 · GHSA-7gqw-825c-3842

Apache Thrift: C++ JSON OOB read

LOW 37

Out-of-bounds Read vulnerability in Apache Thrift.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00896 Published 2026-04-28 Partial fix · 0.23.0 CWE-125

TI-2026-30147 CVE-2026-41606 · GHSA-h5hj-56h4-rwcp

Apache Thrift: c_glib dispatch stack overflow

LOW 32

Uncontrolled Recursion vulnerability in Apache Thrift.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01101 Published 2026-04-28 Partial fix · 0.23.0 CWE-674