CVE-2026-32287VulnerabilityPublished 21 Apr 2026Updated 30 Oct 2026

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release

Affects Red HatSource GCVE Database

Compare

Mentioned vulnerabilities

Not known to be exploited : upgrade Red Hat to 3.9.2 soon.

Data as of 30 Oct 2026, 11:52 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.5% chance of exploitation in 30 days – higher than 45% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 3.9.2

Exploitation evidence

Disclosed: evidence found.
CVE published 21 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Red Hat to 3.9.2.

Affected software

Product	Affected	Fixed in
Red Hat Product Security Red Hat	Affected >=3.9.1 <3.9.2 Red Hat Red Hat OpenShift distributed tracing Red Hat OpenShift distributed tracing 3.9.1 amd64 registry.redhat.io/rhosdt/opentelemetry-operator-bundle@sha256:333a0122b7f40e70c2fa34b7045cd119b2887612e247346a6f344bc998e363ea_amd64 Red Hat OpenShift distributed tracing 3.9.2 Red Hat OpenShift distributed tracing 3.9.0 Red Hat OpenShift distributed tracing 3.9.3	Fixed in 3.9.2

AI-suggested

A fix is available in Red Hat build of OpenTelemetry version 3.9.2. Users should upgrade affected versions (>=3.9.1 <3.9.2) to 3.9.2 or later to remediate these vulnerabilities. The vendor advisory provides detailed upgrade instructions. No additional mitigations or workarounds are noted. There are no breaking changes or deprecations in this update.

Description

This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * XPath library vulnerability is fixed: Previously, the 'github.com/antchfx/xpath' library was vulnerable to a denial of service (DoS) attack. This issue occurred because specially crafted boolean XPath expressions that evaluated to true caused an infinite loop in the 'logicalQuery.Select' function, leading to 100% CPU utilization. With this update, the XPath library properly handles these expressions and prevents infinite loops. As a result, the system is no longer vulnerable to this DoS condition. For more information, see https://access.redhat.com/security/cve/cve-2026-32287. * gRPC-Go authorization bypass vulnerability is fixed: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 ':path' pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed ':path' that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the ':path' pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186. * Go JOSE denial of service vulnerability is fixed: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial of service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986. Known issues: * The filesystem scraper does not produce the `system.filesystem.inodes.usage` and `system.filesystem.usage` metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.

Impact

The XPath library vulnerability allows an attacker to cause a denial of service by triggering an infinite loop that consumes 100% CPU, making the affected system unresponsive. The gRPC-Go vulnerability could allow attackers to bypass authorization controls by sending malformed HTTP/2 requests, potentially gaining unauthorized access or disclosing information. The Go JOSE vulnerability could cause application crashes when processing malformed encrypted JSON Web Encryption objects, leading to denial of service. These vulnerabilities impact system availability and security policy enforcement.

Summary

This Red Hat security advisory addresses several vulnerabilities in the Red Hat build of OpenTelemetry 3.9.2. The primary vulnerability (CVE-2026-32287) involves the 'github.com/antchfx/xpath' library, where specially crafted boolean XPath expressions that evaluate to true cause an infinite loop in the 'logicalQuery.Select' function, resulting in 100% CPU utilization and a denial of service condition. The update corrects this by properly handling such expressions to prevent infinite loops. Additional vulnerabilities fixed include an authorization bypass in gRPC-Go due to improper validation of the HTTP/2 ':path' pseudo-header, and a denial of service in the Go JOSE library caused by malformed JSON Web Encryption objects. The advisory confirms no breaking changes or deprecations and provides instructions for upgrading. The affected product is Red Hat OpenShift distributed tracing, specifically versions >=3.9.1 and <3.9.2. No exploits are currently known in the wild.

CWE-606Unchecked Input for Loop Condition (opens in a new tab)
Base weakness
The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Implementation
Do not use user-controlled data for loop conditions.
Implementation
Perform input validation.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization (opens in a new tab)
Base weakness
If a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
Architecture and Design
URL Inputs should be decoded and canonicalized to the application's current internal representation before being validated and processed for authorization. Make sure that your application does not decode the same input twice.
OWASP ASVS 4.0.3
V8.3.8 (opens in a new tab)
V13.4.2 (opens in a new tab)
V7.2.2 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-131Incorrect Calculation of Buffer Size (opens in a new tab)
Base weaknessLikelihood of exploit: High
The product does not correctly calculate the size to be used when allocating a buffer.
Implementation
When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input…
Implementation
Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles…
Implementation · Input Validation
Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.
Attack patterns
Overflow Buffers (opens in a new tab)
Buffer Overflow via Parameter Expansion (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Aug 2026, 17:05 UTC

WeaknessesCWE-606, CWE-551, CWE-131

Technical details

References

Community reviews

Related threats