VDB
RHSA-2026:67542
RHSA-2026:67542
PUBLISHED
CVSS 7.699999809265137 HIGH
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.
Risk Scores
CVSS 3.1
7.699999809265137
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhacm2/thanos-receive-controller-rhel9@sha256:62cee037a2d6410dfecaa2db318bcfdbd3217eba6cf56e7d5b1c020fab8734ef_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-subscription-rhel9@sha256:e12e7f42c2ad309f907ea530148d0bb25d15d163a8087b76aa65ac35cae379f1_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-rhel9@sha256:96be5131a9cecda061e2aad4d54f197a70461f9880258c8074cec14d1429b1f2_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9@sha256:20af3491bffb8950ea80b02650579f59105bb05ff0bb0befd6b19f28a02c7199_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/prometheus-rhel9@sha256:56dbb65466d50a494d760e34e9e12529f974267effae1b72798df78320df169f_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-indexer-rhel9@sha256:0e47cadb39423f697a2a77542f4d5343161a924b90d9631e01fd21dec3c21ad4_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9@sha256:fece2c51ecc1ebff09d332d70156e499797949a7b99b5266494d7d42ef3f2cb0_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-observability-rhel9-operator@sha256:9d9fbbc47e0b568640307a58c1bc0dfbf3365fa61ffa7b7aa38d9248e8d9e947_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/search-collector-rhel9@sha256:cf375122f2a98b539a84ef419d988f9b05aa62190169822c9acb5c43afdc2b45_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/rbac-query-proxy-rhel9@sha256:c9d8dfde8c65f42cb9d9e9eb2b62fe0a5b5ec04f632434dd6ef6eca18b4d75c3_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/node-exporter-rhel9@sha256:2618aff0c500ae041794de34b7d87f46e6f63a9490dac1f9de772ddd12a6f455_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-search-v2-api-rhel9@sha256:488d5dc1d5891b0adb3be0923485152ced79927c8f4e58a23ea7f5e2db16470e_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/endpoint-monitoring-rhel9-operator@sha256:bf335f24da3de22bb406cf26dc28126263e2db037eb082cd112394d21b1b4097_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/cluster-backup-rhel9-operator@sha256:b4287348bdde8b0114e80a1de5c9188159a7ad40cdec1099ad7cb8c1ed7af8c4_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/governance-policy-propagator-rhel9@sha256:e94b11cbb87e8c2f551328525ea8bff72c6a3690390a41af653d57dd806a1879_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/submariner-addon-rhel9@sha256:0745aee7730507464b913e1af00d3b575f60e1c9d5c666e9f02dba57d1dab1ae_s390x as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/acm-cluster-permission-rhel9@sha256:57105911a22500e4a4d97e15fe6a8a79c6bd74182223d5fd2e28b9c50cce3575_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/mtv-integrations-rhel9@sha256:33c7ec03fc9e9e04a91ff5111843de402d5f45d36f0ec0bfe863a9e3b784aadb_amd64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/multicluster-operators-application-rhel9@sha256:250bebf41347bc84fa9ba88d83990c83bb486ebae50a57c5bbf4671c395539ca_ppc64le as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
| Red Hat | registry.redhat.io/rhacm2/insights-metrics-rhel9@sha256:e98e8d30b19d82094cde0a5392372a93898944c660521d3e5244df345aea6b31_arm64 as a component of Red Hat Advanced Cluster Management for Kubernetes 2.16 | * |
…and 168 more
Timeline
- Sep 15, 2026 CVE Published
- Sep 23, 2026 CVE Updated
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Distribution Patch
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
- Sep 23, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:67542 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-48586 advisory
- https://access.redhat.com/security/cve/CVE-2026-55969 advisory
- https://access.redhat.com/security/cve/CVE-2026-56852 advisory
- https://access.redhat.com/security/cve/CVE-2026-66780 advisory
- https://access.redhat.com/security/cve/CVE-2026-71556 advisory
- https://access.redhat.com/security/cve/CVE-2026-75899 advisory
- https://access.redhat.com/security/cve/CVE-2026-75931 advisory
- https://access.redhat.com/security/cve/CVE-2026-75975 advisory
- https://access.redhat.com/security/cve/CVE-2026-76172 advisory
- https://access.redhat.com/security/cve/CVE-2026-89060 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67542.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484830 issue
- https://www.cve.org/CVERecord?id=CVE-2026-41178 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41178 advisory
- https://github.com/open-telemetry/opentelemetry-go/pull/7880 advisory
…and 58 more