This advisory covers security fixes in the Red Hat build of OpenTelemetry Collector for Red Hat Enterprise Linux 10.0 Extended Update Support. The update addresses eight CVEs: CVE-2026-25679 (incorrect parsing of IPv6 host literals in net/url), CVE-2026-33186 (authorization bypass in gRPC-Go due to improper HTTP/2 path validation), CVE-2026-34986 (denial of service via crafted JSON Web Encryption objects in go-jose), CVE-2026-32281 and CVE-2026-32280 (denial of service vulnerabilities in Go crypto/x509 certificate chain validation), CVE-2026-33810 (certificate validation bypass due to incorrect DNS constraint application), CVE-2026-32282 (Root.Chmod following symlinks out of root in internal/syscall/unix), and CVE-2026-32283 (denial of service via multiple TLS 1.3 key update messages in crypto/tls). The advisory provides updated packages for multiple architectures and references Red Hat's official errata for remediation details.

The vulnerabilities collectively could allow attackers to bypass authorization checks, cause denial of service conditions, and bypass certificate validation in affected OpenTelemetry Collector components. These issues impact the security and reliability of systems running the affected versions of Red Hat Enterprise Linux 10.0 Extended Update Support with the OpenTelemetry Collector. The severity is rated as Important by Red Hat, indicating a high risk to affected systems if unpatched.

Red Hat has released updated packages for the OpenTelemetry Collector in Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the updates as detailed in the Red Hat advisory RHSA-2026:19719 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. No additional mitigation steps are indicated beyond applying the official patches.