Red Hat Security Advisory

RHSA-2026:88187

Red Hat OpenShift distributed tracing platform (Tempo) 3.11.3 release

Released 2026-10-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift distributed tracing 3.11 registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9, registry.redhat.io/rhosdt/tempo-gateway-rhel9, registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9 +3

Fixes 2 records

TI-2026-70749 CVE-2026-108859 · GHSA-c673-ppxx-9wvj

mcp-go Denial of Service via Unbounded POST Body Buffering

MEDIUM 44

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00545 Published 2026-10-11 Partial fix CWE-770

TI-2026-78632 CVE-2026-111943

Go crypto/x509 accepts known compromised intermediate certificates

LOW 32

On most platforms, Go uses the given system root certificates.

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00396 Published 2026-10-21 Partial fix · 1.26.10, 1.27.3 CWE-299