Read the docs
Red Hat Security Advisory

RHSA-2026:77532

Release of components for Service Telemetry Framework 1.5.7

Released 2026-10-07 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 7 records

TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9

Quadratic complexity in WordDecoder.DecodeHeader in mime

Priority MEDIUM 40

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0056 Published 2026-06-02 Partial fix · 1.25.11, 1.26.4 CWE-407
TI-2026-26189 CVE-2026-33818 · GHSA-xc2p-8ggw-6cr5

Enforce maximum recursion depth in encoding/asn1

Priority MEDIUM 40

Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00568 Published 2026-08-13 Partial fix · 1.25.13, 1.26.6 +1 CWE-400
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478

Crash when handling long CNAME response in net

Priority MEDIUM 40

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00875 Published 2026-05-07 Partial fix · 1.25.10, 1.26.3 CWE-415
TI-2026-24810 CVE-2026-32281 · GHSA-gjvh-7jh8-7xhm

Inefficient policy validation in crypto/x509

Priority LOW 39

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00361 Published 2026-04-08 Partial fix · 1.25.9, 1.26.2 CWE-295
TI-2026-40998 CVE-2026-56860 · GHSA-25mv-j2qr-v5jq

Avoid quadratic complexity in resolvePath in net/url

Priority LOW 27

Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0055 Published 2026-08-13 Partial fix · 1.25.13, 1.26.6 +1 CWE-407