Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878. * Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602. * Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280. * TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU. * IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111. Known issues: * The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
AI Analysis
Technical Summary
The Red Hat build of OpenTelemetry 3.9.3 release includes security improvements fixing several vulnerabilities. The cap_set_file() function in libcap had a TOCTOU race condition allowing local unprivileged users with write access to a parent directory to redirect file capability updates to attacker-controlled files, enabling privilege escalation. An integer overflow in Apache Thrift TFramedTransport Go implementation could cause denial of service. The Go crypto/x509 and crypto/tls packages improperly limited intermediate certificates during chain building, leading to denial of service. TLS 1.3 connections could deadlock when receiving multiple key update messages in a single record, causing denial of service. A systemd IPC API flaw allowed unprivileged users to cause stack overwriting or denial of service depending on version. These issues are fixed in this release, and file capability updates, certificate processing, TLS connections, and IPC API calls are now correctly handled to prevent exploitation.
Potential Impact
The vulnerabilities could allow local unprivileged users to escalate privileges by injecting or stripping file capabilities due to the TOCTOU race condition in cap_set_file(). Integer overflow and certificate processing flaws could lead to denial of service conditions, making affected systems or applications unavailable. The TLS 1.3 deadlock vulnerability also results in denial of service through resource exhaustion. The systemd IPC API flaw could lead to arbitrary code execution or privilege escalation on older versions, or denial of service on newer versions. These impacts affect confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
A fixed release, Red Hat build of OpenTelemetry 3.9.3, is available and should be applied to remediate these vulnerabilities. The update corrects the TOCTOU race condition, integer overflow, denial of service flaws, TLS deadlock, and systemd IPC API validation issues, rendering the vulnerabilities no longer exploitable. Users should follow Red Hat's official guidance to upgrade to version 3.9.3 or later. No additional mitigations are indicated or required beyond applying this update.
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release
Description
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878. * Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602. * Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280. * TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU. * IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111. Known issues: * The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Red Hat build of OpenTelemetry 3.9.3 release includes security improvements fixing several vulnerabilities. The cap_set_file() function in libcap had a TOCTOU race condition allowing local unprivileged users with write access to a parent directory to redirect file capability updates to attacker-controlled files, enabling privilege escalation. An integer overflow in Apache Thrift TFramedTransport Go implementation could cause denial of service. The Go crypto/x509 and crypto/tls packages improperly limited intermediate certificates during chain building, leading to denial of service. TLS 1.3 connections could deadlock when receiving multiple key update messages in a single record, causing denial of service. A systemd IPC API flaw allowed unprivileged users to cause stack overwriting or denial of service depending on version. These issues are fixed in this release, and file capability updates, certificate processing, TLS connections, and IPC API calls are now correctly handled to prevent exploitation.
Potential Impact
The vulnerabilities could allow local unprivileged users to escalate privileges by injecting or stripping file capabilities due to the TOCTOU race condition in cap_set_file(). Integer overflow and certificate processing flaws could lead to denial of service conditions, making affected systems or applications unavailable. The TLS 1.3 deadlock vulnerability also results in denial of service through resource exhaustion. The systemd IPC API flaw could lead to arbitrary code execution or privilege escalation on older versions, or denial of service on newer versions. These impacts affect confidentiality, integrity, and availability of affected systems.
Mitigation Recommendations
A fixed release, Red Hat build of OpenTelemetry 3.9.3, is available and should be applied to remediate these vulnerabilities. The update corrects the TOCTOU race condition, integer overflow, denial of service flaws, TLS deadlock, and systemd IPC API validation issues, rendering the vulnerabilities no longer exploitable. Users should follow Red Hat's official guidance to upgrade to version 3.9.3 or later. No additional mitigations are indicated or required beyond applying this update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:14162
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-29111","CVE-2026-32280","CVE-2026-32283","CVE-2026-41602"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a16097de29bf47b50649dc9
Added to database: 05/26/2026, 20:58:37 UTC
Last enriched: 08/15/2026, 00:13:40 UTC
Last updated: 09/14/2026, 22:01:35 UTC
Views: 131
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.