The Red Hat security advisory RHSA-2025:7407 addresses four vulnerabilities in the opentelemetry-collector package and its dependencies. These include CVE-2025-27144 (denial of service via go-jose parsing), CVE-2025-22868 (unexpected memory consumption during token parsing in golang.org/x/oauth2/jws), CVE-2025-29786 (memory exhaustion in expr parser with unrestricted input), and CVE-2025-30204 (excessive memory allocation during jwt-go header parsing). The vulnerabilities can cause denial of service or resource exhaustion due to improper handling of input data. The advisory covers multiple architectures and extended update support versions of Red Hat Enterprise Linux 9. Updated packages are available to fix these issues, and users should refer to the Red Hat article for update instructions.

The vulnerabilities can lead to denial of service or memory exhaustion conditions in systems running the affected opentelemetry-collector versions on Red Hat Enterprise Linux 9. This may cause service disruption or degraded performance due to excessive memory allocation triggered by specially crafted inputs during parsing operations in the affected components. No known exploits in the wild have been reported at this time.

Red Hat has released updated opentelemetry-collector packages that address these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2025:7407 and the referenced article https://access.redhat.com/articles/11258. Applying the official patch is the recommended remediation. No additional mitigation steps are indicated by the vendor advisory.