Red Hat Security Advisory

RHSA-2026:34357

opentelemetry-collector security update

Released 2026-07-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) opentelemetry-collector-0.152.1-1.el10_2

TI-2026-28703 CVE-2026-39821 · GHSA-w2q5-6q6x-x959

MEDIUM 47

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.01834 Published 2026-05-22 Partial fix · 1.25.13, 1.26.6 +2 CWE-1289

TI-2026-30483 CVE-2026-42154 · GHSA-8rm2-7qqf-34qm

MEDIUM 40

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00813 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +2 CWE-400

TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478

MEDIUM 40

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00875 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-415

TI-2026-30481 CVE-2026-42151 · GHSA-wg65-39gg-5wfj

LOW 39

Prometheus is an open-source monitoring system and time series database.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00352 Published 2026-05-04 Partial fix · 3.5.3, 3.11.3 +1 CWE-200

TI-2026-21595 CVE-2026-27145 · GHSA-4279-q6mj-392r

LOW 30

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00591 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4

TI-2026-20766 CVE-2026-25681 · GHSA-w9p8-pvxh-rxpj

LOW 27

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00223 Published 2026-05-22 Partial fix · 0.55.0 CWE-1021