VDB
RHSA-2026:77639
RHSA-2026:77639
PUBLISHED
CVSS 6.099999904632568 MEDIUM
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:26b899f654e17f0e6fae80859a4455efed141a5db62a9fde2dd1ffcb57eda396_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4 | * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:b18585062c47e8ff7cd973bfb0faa920aa85608501e952e7b053d4ebb337bdd4_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:5867a6765408efba2f8a4a5f06a7cf3a108b7144074681d437254f88cdf8d904_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:51825481204047d89d21c390c369f60c2d7c6f90d1b9688b249eef79ec8308be_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:85ce6360373096dae5338fd372359d186457b583b8c403b84741f59ac2e926d9_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c21fc4fc18a3cd7bac6ef26b1ea5678277e768eb0df9a1e9567396cad4290ebc_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:140282663fbcf4c0bc14fd5928cb5b5bf395f152e0bccea6c024daec038cb1eb_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:f1ceed7fbc7bffbf4799ebef749fae87bcf1acb265367299bbd771f94198301f_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:cdc2c9394d14cae8bb2d81dc02643f5463045e03b7ec93951146ca8b116905e9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:c90304afb7cd803c1fc0749696850360899e705ff3ce5fd8bd1228135412d6a8_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec0a79d78677c143d5bf08ba24ce87e06b97a4b29df721276170cfd3ccd443d3_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4 | * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a2b5a0c0323b844fcdc09360603c6f2f263cd391c012461de71a951cec39bd0b_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:8f92a06f20fece433448c93d337f648dda47340114ab62076b604134b7dbfc03_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:8b1c4331b5b8b0eee432af830a11f6cf43d9699d790d09c011b2b1a02007ca13_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:3644b09eff92d9406079df144b8083633c0218c3efa48d2411a1b18627b5e9d2_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:cfe363b8dcd6f87cb6ff16fb1deab90539ec611712ed47fa1cd796e38ffa7dac_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:2c2c98561106ba1395ef994d0168860e8d5c0a16ffcb2bbaf9de30afd2daaee9_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:e9dcf615c12e91f47b951ce8d231a1a81231ecee294e88d926890bedd6e2546d_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a5cdae5033367bd2dfb2afe58b141eb3b081efc8ff08a92ee7baae9493673eae_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
| Red Hat | registry.redhat.io/openshift-logging/vector-rhel9@sha256:3688f9448ea2ce01c3ec0c1d5b9e8644300c138ef5fd1c94459b5c00b97cf58c_s390x as a component of Logging Subsystem for Red Hat OpenShift 6.4 | *, * |
…and 14 more
Timeline
- Oct 7, 2026 CVE Published
- Oct 12, 2026 CVE Updated
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Distribution Patch
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
- Oct 12, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:77639 advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-42151 advisory
- https://access.redhat.com/security/cve/CVE-2026-42154 advisory
- https://access.redhat.com/security/cve/CVE-2026-42502 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_77639.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484830 issue
- https://www.cve.org/CVERecord?id=CVE-2026-41178 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41178 advisory
- https://github.com/open-telemetry/opentelemetry-go/pull/7880 advisory
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2466507 issue
- https://www.cve.org/CVERecord?id=CVE-2026-42151 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-42151 advisory
- https://github.com/prometheus/prometheus/pull/18587 advisory
- https://github.com/prometheus/prometheus/pull/18590 advisory
- https://github.com/prometheus/prometheus/releases/tag/v3.11.3 advisory
- https://github.com/prometheus/prometheus/releases/tag/v3.5.3 advisory
- https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj advisory
…and 13 more