Skip to main content
CVE-2024-45336VulnerabilityPublished Updated

Red Hat Security Advisory: opentelemetry-collector security update

Affects Red HatSource GCVE Database

0

Mentioned vulnerabilities

Not known to be exploited.

Data as of 25 Oct 2026, 22:09 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
0.7% chance of exploitation in 30 days – higher than 53% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 3 Apr 2025

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponised: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

What to do

Affected software

ProductAffectedFixed in
Red Hat Product Security Red HatAffected
  • Red Hat
  • Red Hat Enterprise Linux
  • Red Hat Enterprise Linux AppStream EUS (v.9.4)
  • src
  • opentelemetry-collector-0:0.107.0-7.el9_4.src
Fixed in–

AI-suggested

Red Hat has released updated packages for the OpenTelemetry Collector in Red Hat Enterprise Linux 9.4 Extended Update Support and related variants. Users should apply these official updates as described in Red Hat's advisory (RHSA-2025:3593) and the update instructions at https://access.redhat.com/articles/11258. No alternative mitigations are noted in the advisory. Applying the vendor-provided patches is the recommended remediation.

Description

Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336) * go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144) * golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868) * github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Community reviews

Loading reviews…