Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878. * Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602. * Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280. * TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU. * IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111. Known issues: * The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
AI Analysis
Technical Summary
This Red Hat security advisory for the OpenTelemetry 3.9.3 release includes fixes for several vulnerabilities: (1) A TOCTOU race condition in libcap's cap_set_file() function allowed local unprivileged users with write access to a parent directory to redirect file capability updates to attacker-controlled files, enabling privilege escalation. (2) An integer overflow in the Apache Thrift TFramedTransport Go implementation could cause unexpected behavior or resource exhaustion leading to denial of service. (3) The Go crypto/x509 and crypto/tls packages did not limit the number of intermediate certificates processed during chain building, allowing denial of service via excessive certificate chains. (4) TLS 1.3 connections could deadlock if multiple key update messages were sent in a single record, causing resource exhaustion and denial of service. (5) An IPC API flaw in systemd allowed unprivileged users to cause stack overwrites or denial of service depending on version, potentially enabling code execution or privilege escalation. All these vulnerabilities have been fixed in this release, eliminating their exploitability. The advisory also notes a known issue with filesystem scraper metrics after upgrading with no workaround. The affected product is Red Hat OpenShift distributed tracing. No cloud service is involved; patching is managed by the vendor through this release.
Potential Impact
The vulnerabilities fixed in this release could have allowed local unprivileged users to escalate privileges by manipulating file capabilities, attackers to cause denial of service through resource exhaustion or deadlocks in TLS connections, and potentially arbitrary code execution or denial of service via IPC API flaws in systemd. These impacts affect system availability, integrity, and confidentiality. The fixes remove these risks by correcting race conditions, integer overflows, certificate processing limits, TLS message handling, and IPC validation.
Mitigation Recommendations
A fix is available in the Red Hat build of OpenTelemetry 3.9.3 release. Users should apply this update to remediate the described vulnerabilities. For detailed upgrade instructions, refer to Red Hat's official documentation on upgrading operators in OpenShift. No additional mitigations are required as the vulnerabilities are no longer exploitable after applying this update.
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.3 release
Description
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * TOCTOU race condition in libcap cap_set_file() function is fixed. Previously, the cap_set_file() function in libcap contained a Time-of-check-to-time-of-use (TOCTOU) race condition. A local unprivileged user with write access to a parent directory could exploit this vulnerability to redirect file capability updates to an attacker-controlled file. This flaw allowed an attacker to inject capabilities into or strip capabilities from unintended executables, leading to privilege escalation. With this update, the race condition in cap_set_file() is fixed. As a result, file capability updates are applied to the intended target files, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-4878. * Integer overflow vulnerability in Apache Thrift TFramedTransport Go implementation is fixed. Previously, the Apache Thrift TFramedTransport Go language implementation contained an integer overflow or wraparound vulnerability. An attacker could exploit this flaw to cause unexpected behavior or resource exhaustion, leading to a denial of service. With this update, the integer overflow issue is fixed. As a result, TFramedTransport correctly handles integer values, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-41602. * Denial of service vulnerability in Go crypto/x509 and crypto/tls packages is fixed. Previously, the Go standard library packages crypto/x509 and crypto/tls did not properly limit the number of intermediate certificates processed during certificate chain building. An attacker could provide an excessive number of intermediate certificates, causing an uncontrolled amount of work. This flaw could result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users. With this update, the number of intermediate certificates processed during certificate chain building is properly limited. As a result, the packages handle certificate chains efficiently, and the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-32280. * TLS 1.3 connection deadlock vulnerability is fixed. Previously, if one side of a TLS 1.3 connection sent multiple key update messages post-handshake in a single record, the connection could deadlock. This deadlock caused uncontrolled consumption of resources and could lead to a denial of service. With this update, TLS 1.3 connections correctly handle multiple key update messages in a single record. As a result, connections no longer deadlock, and the vulnerability is no longer exploitable. For more information about CVE-2026-32283, see https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU. * IPC API vulnerability in systemd is fixed. Previously, system and service manager systemd contained a flaw that an unprivileged user could exploit by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this flaw could lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), this flaw caused systemd to assert and freeze, resulting in a denial of service (DoS). With this update, systemd correctly validates IPC API calls. As a result, the vulnerability is no longer exploitable. For more information, see https://access.redhat.com/security/cve/CVE-2026-29111. Known issues: * The filesystem scraper does not produce the system.filesystem.inodes.usage and system.filesystem.usage metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
CVSS v3.1
Score 6.7medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory for the OpenTelemetry 3.9.3 release includes fixes for several vulnerabilities: (1) A TOCTOU race condition in libcap's cap_set_file() function allowed local unprivileged users with write access to a parent directory to redirect file capability updates to attacker-controlled files, enabling privilege escalation. (2) An integer overflow in the Apache Thrift TFramedTransport Go implementation could cause unexpected behavior or resource exhaustion leading to denial of service. (3) The Go crypto/x509 and crypto/tls packages did not limit the number of intermediate certificates processed during chain building, allowing denial of service via excessive certificate chains. (4) TLS 1.3 connections could deadlock if multiple key update messages were sent in a single record, causing resource exhaustion and denial of service. (5) An IPC API flaw in systemd allowed unprivileged users to cause stack overwrites or denial of service depending on version, potentially enabling code execution or privilege escalation. All these vulnerabilities have been fixed in this release, eliminating their exploitability. The advisory also notes a known issue with filesystem scraper metrics after upgrading with no workaround. The affected product is Red Hat OpenShift distributed tracing. No cloud service is involved; patching is managed by the vendor through this release.
Potential Impact
The vulnerabilities fixed in this release could have allowed local unprivileged users to escalate privileges by manipulating file capabilities, attackers to cause denial of service through resource exhaustion or deadlocks in TLS connections, and potentially arbitrary code execution or denial of service via IPC API flaws in systemd. These impacts affect system availability, integrity, and confidentiality. The fixes remove these risks by correcting race conditions, integer overflows, certificate processing limits, TLS message handling, and IPC validation.
Mitigation Recommendations
A fix is available in the Red Hat build of OpenTelemetry 3.9.3 release. Users should apply this update to remediate the described vulnerabilities. For detailed upgrade instructions, refer to Red Hat's official documentation on upgrading operators in OpenShift. No additional mitigations are required as the vulnerabilities are no longer exploitable after applying this update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:14162
- Cve Count
- 5
- Additional Cves
- ["CVE-2026-29111","CVE-2026-32280","CVE-2026-32283","CVE-2026-41602"]
- Cvss Version
- 3.1
Threat ID: 6a16097de29bf47b50649dc9
Added to database: 05/26/2026, 20:58:37 UTC
Last enriched: 07/30/2026, 11:11:38 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 98
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.