Red Hat Security Advisory

RHSA-2026:9388

Red Hat build of OpenTelemetry 3.9.2 release

Released 2026-04-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat OpenShift distributed tracing 3.9.3 registry.redhat.io/rhosdt/opentelemetry-collector-rhel9, registry.redhat.io/rhosdt/opentelemetry-rhel9-operator, registry.redhat.io/rhosdt/opentelemetry-target-allocator-rhel9

Fixes 3 records

TI-2026-24816 CVE-2026-32287 · GHSA-65xw-vw82-r86x

Infinite loop in github.com/antchfx/xpath

HIGH 72

Boolean XPath expressions that evaluate to true can cause an infinite loop in logicalQuery.Select, leading to 100% CPU usage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00539 Published 2026-03-26 Partial fix · 1.3.6 CWE-835

TI-2026-25614 CVE-2026-33186 · GHSA-p77j-4mvh-x3m3

gRPC-Go has an authorization bypass via missing leading slash in :path

MEDIUM 49

gRPC-Go is the Go language implementation of gRPC.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01619 Published 2026-03-20 Partial fix · 1.79.3 CWE-285

TI-2026-27208 CVE-2026-34986 · GHSA-78h2-9frx-2jm8

Go JOSE affect by a panic in JWE decryption

MEDIUM 40

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00663 Published 2026-04-06 Partial fix · 4.1.4, 3.0.5 CWE-248