VDB
RHSA-2026:83597
RHSA-2026:83597
PUBLISHED
CVSS 7.099999904632568 HIGH
A flaw was found in OpenTelemetry-Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending oversized or invalid baggage headers. The `Parse` function, in affected versions, failed to reject raw-length inputs, leading to excessive processing and error logging when handling these large inputs.
Risk Scores
CVSS 3.1
7.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhtas/cosign-rhel9@sha256:44f0c5a3ee95b60e098f1a0733d9d366a169eb076fc6fe945e7a7baa1bc3ea3a_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:1f3293c5a27d2b700a3e23ef13c24b1a15430044c4fab59424e86e37daded7e2_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/updatetree-rhel9@sha256:1b5ad5a8f7340144a258850e2355cc50e00c6ca02f3a00b408e32c3cb37e625d_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/gitsign-rhel9@sha256:f4dd8d1a262bb52a6b2820688722b481c6f937fe5b4e195c1373b663fa92ed41_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/cosign-rhel9@sha256:f7019515c53440f22ebe3340c8905fed2805ac2cd1d4022b5c5c03b39d4d1877_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/gitsign-rhel9@sha256:a157004db3bc40a7950e0497eb68de33b6487432bd21401b79ac8241caf91718_arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/gitsign-rhel9@sha256:c966b927c8a79651ad43b65f4db3f973ceb0d1fb2b16f9b3be664386980134da_s390x as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:4f80195221738a5ffdc3f56d221d21ba7e0a2a12fa8fca56a78f410fdc085673_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/cosign-rhel9@sha256:b71496adedc9117419b4209aea3ae17f042d6e36f6a8ff25cd4b56649b0aed30_arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/updatetree-rhel9@sha256:15bdaaf88059eae0c63c812671becb209f9c5933bb76feb050bcee8b211b934c_s390x as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/updatetree-rhel9@sha256:fce239ee2f73cbf5b697fafbfa07f5432b81cc9fdcc4ab786be984744172516f_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/cosign-rhel9@sha256:1125b9898d1a3165fba2c96b143e63e3f8919f2d91cedf7f6899566d394b09c5_s390x as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:7b028accad081f780ad02d4edd45863cbb889eee58e7d58d809e324b58fe27e8_arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/gitsign-rhel9@sha256:2c7eeb52e1d3e6ed08517fc59aedae9586abafceb704917d8b287f123a1872a3_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/updatetree-rhel9@sha256:def61139f02a70a2208bf9e32c06d3ca447c56d2697ed50a3291022c0ae5a53f_arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:b91463128ac80dfde938a8bebe3622e7851c71845c0460130803d9ad413371a2_arm64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:fd290c9b45fee3033695938c37c4bb9da0d4187cfca69ac38e0c2f2b4a2ea795_s390x as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:6e9d9541f521b1eeab96f2dbad1c8784cfe8c6a58d8821033ecd882eefe22a57_s390x as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/rekor-cli-rhel9@sha256:dc15abc35d9bca838ea759844b807f427d545acc5c91c89007b5bb1507574617_amd64 as a component of Red Hat Trusted Artifact Signer 1.4 | * |
| Red Hat | registry.redhat.io/rhtas/fetch-tsa-certs-rhel9@sha256:3659e338589692444a712f36e6c5113502ef7704ece0069ee7c39d59ab7c9c5c_ppc64le as a component of Red Hat Trusted Artifact Signer 1.4 | * |
Timeline
- Oct 15, 2026 CVE Published
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:83597 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4 advisory
- https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.4/html-single/release_notes/index advisory
- https://access.redhat.com/security/cve/CVE-2026-41178 advisory
- https://access.redhat.com/security/cve/CVE-2026-56854 advisory
- https://access.redhat.com/security/cve/CVE-2026-71556 advisory
- https://access.redhat.com/security/cve/CVE-2026-73500 advisory
- https://access.redhat.com/security/cve/CVE-2026-84445 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_83597.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2484830 issue
- https://www.cve.org/CVERecord?id=CVE-2026-41178 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-41178 advisory
- https://github.com/open-telemetry/opentelemetry-go/pull/7880 advisory
- https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2525639 issue
- https://www.cve.org/CVERecord?id=CVE-2026-56854 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-56854 advisory
- https://go.dev/cl/797040 advisory
- https://go.dev/issue/80213 advisory
…and 34 more