Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2 release
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None
AI Analysis
Technical Summary
This advisory covers security fixes in Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2. Key vulnerabilities addressed include: (1) CVE-2026-39821, where golang.org/x/net/idna incorrectly processed certain Punycode labels, allowing attackers to bypass hostname validation and potentially escalate privileges; (2) CVE-2026-39822, where the Go os.Root type allowed symbolic link traversal outside the root directory, enabling unauthorized file system access; (3) CVE-2026-5928, where the GNU C Library's ungetwc function mishandled specific wide character encodings, causing information disclosure or crashes; (4) CVE-2026-5435, a buffer overflow in DNS TSIG record processing in the GNU C Library that could cause memory corruption; and (5) CVE-2026-6238, where malformed DNS responses could cause crashes or uninitialized memory reads. The update fixes these issues by correcting input validation, restricting file system operations, and improving buffer boundary checks.
Potential Impact
Successful exploitation of these vulnerabilities could result in privilege escalation, unauthorized file access outside intended directories, application crashes, information disclosure, and memory corruption. These impacts could affect the confidentiality, integrity, and availability of affected systems running vulnerable versions of the Red Hat OpenShift distributed tracing platform and related components.
Mitigation Recommendations
A fixed version, Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2, is available and should be applied to remediate these vulnerabilities. The vendor advisory confirms that the update corrects the issues without breaking changes or deprecations. Users should upgrade to version 3.10.2 or later following Red Hat's documented upgrade procedures. No additional mitigations are specified or required beyond applying this official fix.
Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2 release
Description
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers security fixes in Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2. Key vulnerabilities addressed include: (1) CVE-2026-39821, where golang.org/x/net/idna incorrectly processed certain Punycode labels, allowing attackers to bypass hostname validation and potentially escalate privileges; (2) CVE-2026-39822, where the Go os.Root type allowed symbolic link traversal outside the root directory, enabling unauthorized file system access; (3) CVE-2026-5928, where the GNU C Library's ungetwc function mishandled specific wide character encodings, causing information disclosure or crashes; (4) CVE-2026-5435, a buffer overflow in DNS TSIG record processing in the GNU C Library that could cause memory corruption; and (5) CVE-2026-6238, where malformed DNS responses could cause crashes or uninitialized memory reads. The update fixes these issues by correcting input validation, restricting file system operations, and improving buffer boundary checks.
Potential Impact
Successful exploitation of these vulnerabilities could result in privilege escalation, unauthorized file access outside intended directories, application crashes, information disclosure, and memory corruption. These impacts could affect the confidentiality, integrity, and availability of affected systems running vulnerable versions of the Red Hat OpenShift distributed tracing platform and related components.
Mitigation Recommendations
A fixed version, Red Hat OpenShift distributed tracing platform (Tempo) 3.10.2, is available and should be applied to remediate these vulnerabilities. The vendor advisory confirms that the update corrects the issues without breaking changes or deprecations. Users should upgrade to version 3.10.2 or later following Red Hat's documented upgrade procedures. No additional mitigations are specified or required beyond applying this official fix.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:42694
- Cve Count
- 3
- Additional Cves
- ["CVE-2026-5928","CVE-2026-6238"]
- Cvss Version
- null
Threat ID: 6a5fd0931010f89cc2199005
Added to database: 07/21/2026, 20:03:31 UTC
Last enriched: 08/14/2026, 23:35:09 UTC
Last updated: 09/04/2026, 22:52:13 UTC
Views: 97
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.