Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes. Breaking changes: * High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169. Deprecations: * Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509. Technology Preview features: * None Enhancements: * High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168. * Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485. Bug fixes: * TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453. * Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435. * Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646. Known issues: * None
AI Analysis
Technical Summary
CVE-2026-32283 is a denial of service vulnerability in the Go standard library crypto/tls package affecting TLS 1.3 connections. The flaw arises when multiple key update messages are sent in a single record post-handshake, causing a deadlock in the connection and uncontrolled resource consumption. This vulnerability is tracked under CWE-667 (Improper Locking) and related CWEs. Red Hat has released security updates for their go-fdo-server packages in Red Hat Enterprise Linux 10 to remediate this issue. The CVSS v3.1 base score is 7.5 (high severity), reflecting network attack vector, low complexity, no privileges required, and high availability impact.
Potential Impact
Exploitation allows a remote attacker to cause a denial of service by triggering a deadlock in TLS 1.3 connections using the Go crypto/tls package. This leads to uncontrolled consumption of system resources, potentially causing application or service unavailability. There is no impact on confidentiality or integrity. The vulnerability affects Red Hat Enterprise Linux 10 products using the affected Go library.
Mitigation Recommendations
A security update fixing this vulnerability is available from Red Hat for affected packages, including go-fdo-server in Red Hat Enterprise Linux 10. Users should apply the provided patches as per Red Hat's advisory (RHSA-2026:19137). No alternative mitigations are specified. Red Hat manages remediation for their products and provides detailed update instructions in their advisory.
Red Hat Security Advisory: Red Hat OpenShift distributed tracing platform (Tempo) 3.11.0 release
Description
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes. Breaking changes: * High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169. Deprecations: * Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509. Technology Preview features: * None Enhancements: * High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168. * Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485. Bug fixes: * TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453. * Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435. * Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646. Known issues: * None
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-32283 is a denial of service vulnerability in the Go standard library crypto/tls package affecting TLS 1.3 connections. The flaw arises when multiple key update messages are sent in a single record post-handshake, causing a deadlock in the connection and uncontrolled resource consumption. This vulnerability is tracked under CWE-667 (Improper Locking) and related CWEs. Red Hat has released security updates for their go-fdo-server packages in Red Hat Enterprise Linux 10 to remediate this issue. The CVSS v3.1 base score is 7.5 (high severity), reflecting network attack vector, low complexity, no privileges required, and high availability impact.
Potential Impact
Exploitation allows a remote attacker to cause a denial of service by triggering a deadlock in TLS 1.3 connections using the Go crypto/tls package. This leads to uncontrolled consumption of system resources, potentially causing application or service unavailability. There is no impact on confidentiality or integrity. The vulnerability affects Red Hat Enterprise Linux 10 products using the affected Go library.
Mitigation Recommendations
A security update fixing this vulnerability is available from Red Hat for affected packages, including go-fdo-server in Red Hat Enterprise Linux 10. Users should apply the provided patches as per Red Hat's advisory (RHSA-2026:19137). No alternative mitigations are specified. Red Hat manages remediation for their products and provides detailed update instructions in their advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:19137
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-33816"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a160978e29bf47b50644e67
Added to database: 05/26/2026, 20:58:32 UTC
Last enriched: 08/14/2026, 21:27:21 UTC
Last updated: 09/15/2026, 07:01:38 UTC
Views: 93
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.