Red Hat Security Advisory: opentelemetry-collector security update
This Red Hat security advisory addresses multiple vulnerabilities in the opentelemetry-collector package for Red Hat Enterprise Linux 10. 0 Extended Update Support. The issues include incorrect IPv6 host parsing, authorization bypass in gRPC-Go, denial of service via crafted JSON Web Encryption objects and TLS key update messages, certificate validation bypass, and symlink following in root. Chmod. The advisory rates the overall impact as Important and provides updated packages to remediate these vulnerabilities. No known exploits in the wild have been reported at this time.
AI Analysis
Technical Summary
The Red Hat opentelemetry-collector package for RHEL 10.0 EUS contains multiple security vulnerabilities spanning several components: net/url (incorrect IPv6 host literal parsing, CVE-2026-25679), gRPC-Go (authorization bypass due to improper HTTP/2 path validation, CVE-2026-33186), Go JOSE (denial of service via crafted JWE objects, CVE-2026-34986), crypto/x509 (denial of service and certificate validation bypass, CVE-2026-32280, CVE-2026-32281, CVE-2026-33810), internal/syscall/unix (symlink following in Root.Chmod, CVE-2026-32282), and crypto/tls (denial of service via multiple TLS 1.3 key update messages, CVE-2026-32283). Red Hat has released updated packages addressing these issues. The advisory references multiple bugzilla entries and CVE pages for detailed technical information.
Potential Impact
The vulnerabilities collectively could allow attackers to bypass authorization controls, cause denial of service conditions, bypass certificate validation, and potentially escalate privileges via symlink attacks. The advisory rates the security impact as Important. No exploits in the wild have been reported. The issues affect Red Hat Enterprise Linux 10.0 Extended Update Support versions of the opentelemetry-collector package across multiple architectures.
Mitigation Recommendations
Red Hat has released updated opentelemetry-collector packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address all listed vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (RHSA-2026:19719) to remediate the issues. Patch status is confirmed as official-fix via the vendor advisory. No additional mitigation steps are indicated beyond applying the provided updates.
Red Hat Security Advisory: opentelemetry-collector security update
Description
This Red Hat security advisory addresses multiple vulnerabilities in the opentelemetry-collector package for Red Hat Enterprise Linux 10. 0 Extended Update Support. The issues include incorrect IPv6 host parsing, authorization bypass in gRPC-Go, denial of service via crafted JSON Web Encryption objects and TLS key update messages, certificate validation bypass, and symlink following in root. Chmod. The advisory rates the overall impact as Important and provides updated packages to remediate these vulnerabilities. No known exploits in the wild have been reported at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat opentelemetry-collector package for RHEL 10.0 EUS contains multiple security vulnerabilities spanning several components: net/url (incorrect IPv6 host literal parsing, CVE-2026-25679), gRPC-Go (authorization bypass due to improper HTTP/2 path validation, CVE-2026-33186), Go JOSE (denial of service via crafted JWE objects, CVE-2026-34986), crypto/x509 (denial of service and certificate validation bypass, CVE-2026-32280, CVE-2026-32281, CVE-2026-33810), internal/syscall/unix (symlink following in Root.Chmod, CVE-2026-32282), and crypto/tls (denial of service via multiple TLS 1.3 key update messages, CVE-2026-32283). Red Hat has released updated packages addressing these issues. The advisory references multiple bugzilla entries and CVE pages for detailed technical information.
Potential Impact
The vulnerabilities collectively could allow attackers to bypass authorization controls, cause denial of service conditions, bypass certificate validation, and potentially escalate privileges via symlink attacks. The advisory rates the security impact as Important. No exploits in the wild have been reported. The issues affect Red Hat Enterprise Linux 10.0 Extended Update Support versions of the opentelemetry-collector package across multiple architectures.
Mitigation Recommendations
Red Hat has released updated opentelemetry-collector packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address all listed vulnerabilities. Users should apply these official updates as described in the Red Hat advisory (RHSA-2026:19719) to remediate the issues. Patch status is confirmed as official-fix via the vendor advisory. No additional mitigation steps are indicated beyond applying the provided updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:19719
- Cve Count
- 8
- Additional Cves
- ["CVE-2026-32280","CVE-2026-32281","CVE-2026-32282","CVE-2026-32283","CVE-2026-33186","CVE-2026-33810","CVE-2026-34986"]
- Cvss Version
- null
Threat ID: 6a160954e29bf47b50619b57
Added to database: 5/26/2026, 8:57:56 PM
Last enriched: 5/26/2026, 9:03:32 PM
Last updated: 5/27/2026, 5:01:10 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.