TI-2026-29801 CVE-2026-41178 · GHSA-5wrp-cwcj-q835
OpenTelemetry-Go's baggage parsing no longer caps raw header length
Priority MEDIUM 63
OpenTelemetry-Go is the Go implementation of OpenTelemetry.
RHSA-2026:54773
Red Hat build of OpenTelemetry 3.10.2 release
Released 2026-08-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat OpenShift distributed tracing 3.10.1 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator
Fixes 5 records
TI-2026-34259 CVE-2026-46600 · GHSA-gg3m-vvp2-p2c5
Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage
Priority MEDIUM 40
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
TI-2026-40992 CVE-2026-56852 · GHSA-jpjm-c3r5-q96r
Infinite loop on invalid input in golang.org/x/text
Priority LOW 39
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
TI-2026-28704 CVE-2026-39822 · GHSA-xcgv-8mv7-v8c7
Root escape via symlink plus trailing slash in os
Priority LOW 36
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.
TI-2026-30788 CVE-2026-42505 · GHSA-ff52-ph69-cf7x
Invoking Encrypted Client Hello privacy leak in crypto/tls
Priority LOW 30
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.