This security advisory for Red Hat build of OpenTelemetry 3.9.2 fixes three main vulnerabilities: CVE-2026-32287 addresses a denial of service in the 'github.com/antchfx/xpath' library where specially crafted boolean XPath expressions caused infinite loops and 100% CPU utilization; CVE-2026-33186 fixes an authorization bypass in gRPC-Go due to improper validation of the HTTP/2 ':path' pseudo-header allowing attackers to bypass security policies by sending malformed ':path' headers without a leading slash; CVE-2026-34986 resolves a denial of service in the Go JOSE library where decrypting malformed JSON Web Encryption objects with empty encrypted key fields caused application crashes. The update ensures proper validation and handling to prevent these issues. There are no breaking changes or deprecations, and no known exploits in the wild. The advisory includes a known issue with filesystem metrics collection after upgrading the collector component, with no current workaround. The vendor provides official fixes in this release.

The vulnerabilities fixed in this release could lead to denial of service conditions causing high CPU usage or application crashes, and an authorization bypass allowing unauthorized access or information disclosure. These issues affect components used in Red Hat OpenShift distributed tracing and related OpenTelemetry deployments. Successful exploitation could disrupt service availability or compromise security policies. However, no known exploits are reported in the wild at this time.

An official fix is available in Red Hat build of OpenTelemetry 3.9.2. Users should apply this update to remediate the XPath library denial of service, gRPC-Go authorization bypass, and Go JOSE denial of service vulnerabilities. For upgrade instructions, refer to Red Hat's documentation on upgrading operators in OpenShift. No additional mitigations are required beyond applying the update. Note the known issue with filesystem scraper metrics after upgrading; monitor Red Hat's issue tracker for updates.