VDB
RHSA-2026:79368
RHSA-2026:79368
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in the klauspost/compress package. A remote attacker can exploit this vulnerability by supplying a specially crafted compression dictionary with an excessively large repeat value, triggering an integer overflow. When the dictionary is subsequently processed, this overflow leads to out-of-bounds memory access, crashing the application and resulting in a Denial of Service (DoS).
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:fe9b9952255c38623d4137d53c97e8f5be1c53d194852879cd7a1ed4bde221fc_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:3b9b141e6bb0e3719d4849b50cac3d4bb5dff70d0f9c7facf9a1c3959c39809a_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:ecc7580567c2cba4d4713cf1150199602d5e1e32fc3dbcff94c919ef8284793e_arm64 as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-rhel9@sha256:0865876c71ccc7fdc1b2a2d196e0696775b138d20500975a2a1c27eed664921f_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:62cb818fb9f042e93882653553b05ac93ab4af6f53cc76e06961431bd0d29777_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:6926706aae8b7962090ecbcbef8a5a14b202ec664af46da459b4b973a8f96cc0_arm64 as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:1f6a0b8a1494cdf6e986b3f44a1c95166b0202493729b16d8186222f1383012e_amd64 as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:f38c3b495fc40edd240b25cc817d5df765cafae7df78af74dc477644d0b85c85_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:0eebef370f834b7d69dd8490f0b1bc527c831733a5d720bed1e3dc52e6ee36bc_arm64 as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-operator-bundle@sha256:a0080dbd55d476469c23c601acb8eaadc7ba76ffae1fa54a6de3cee80f57884a_amd64 as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:3b9b141e6bb0e3719d4849b50cac3d4bb5dff70d0f9c7facf9a1c3959c39809a_amd64 as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-gateway-opa-rhel9@sha256:52c0b0ba51b1693fd9a432430043b6bab3acdc00b194dba14c161d86689ef741_arm64 as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:62cb818fb9f042e93882653553b05ac93ab4af6f53cc76e06961431bd0d29777_amd64 as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:1bc2b104522c69db59de3b978e011d1e456177c447d6cba375e08a696feaac06_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:9fe2e78239cb9ebc887da81942caad4bdc158aa7de85a70d34d3f3d6bf81b777_s390x as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:ad854742100555bc55b7d0094f6a6c8857db9608cbc143d156cfffe2834f0936_s390x as a component of Red Hat OpenShift distributed tracing 3.11 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-rhel9-operator@sha256:cfe1f26d6241897ea7fbe1d48bf8aa3023661c040e2f6e68951c2dfb68610b04_s390x as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-jaeger-query-rhel9@sha256:6d0353c813fbdb73419cda2ebfa7eeebe4e365347987e36d7a01048190cd4256_s390x as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-gateway-rhel9@sha256:f38c3b495fc40edd240b25cc817d5df765cafae7df78af74dc477644d0b85c85_ppc64le as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
| Red Hat | registry.redhat.io/rhosdt/tempo-query-rhel9@sha256:12733ff41a66660b8a2b5f4237252ccef19ebfb79e45fcbc9781cc20c2c53e91_amd64 as a component of Red Hat OpenShift distributed tracing 3.11.3 | * |
…and 30 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:79368 advisory
- https://access.redhat.com/security/cve/CVE-2026-63209 advisory
- https://access.redhat.com/security/cve/CVE-2026-83663 advisory
- https://access.redhat.com/security/cve/CVE-2026-84445 advisory
- https://access.redhat.com/security/cve/CVE-2026-94637 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/distributed_tracing/distributed-tracing-platform-tempo advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79368.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2543236 issue
- https://www.cve.org/CVERecord?id=CVE-2026-63209 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63209 advisory
- https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536 advisory
- https://github.com/klauspost/compress/releases/tag/v1.18.7 advisory
- https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2545170 issue
- https://www.cve.org/CVERecord?id=CVE-2026-83663 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-83663 advisory
- https://lists.apache.org/thread/33otcgbqd27wf6qq810q56znzbomnhg1 advisory
- https://lists.apache.org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjct advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2533175 issue
…and 16 more