Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * XPath library vulnerability is fixed: Previously, the 'github.com/antchfx/xpath' library was vulnerable to a denial of service (DoS) attack. This issue occurred because specially crafted boolean XPath expressions that evaluated to true caused an infinite loop in the 'logicalQuery.Select' function, leading to 100% CPU utilization. With this update, the XPath library properly handles these expressions and prevents infinite loops. As a result, the system is no longer vulnerable to this DoS condition. For more information, see https://access.redhat.com/security/cve/cve-2026-32287. * gRPC-Go authorization bypass vulnerability is fixed: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 ':path' pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed ':path' that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the ':path' pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186. * Go JOSE denial of service vulnerability is fixed: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial of service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986. Known issues: * The filesystem scraper does not produce the `system.filesystem.inodes.usage` and `system.filesystem.usage` metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
AI Analysis
Technical Summary
This security advisory for Red Hat build of OpenTelemetry 3.9.2 fixes three vulnerabilities: CVE-2026-32287 addresses a denial of service in the 'github.com/antchfx/xpath' library caused by specially crafted boolean XPath expressions leading to infinite loops and 100% CPU utilization. CVE-2026-33186 fixes an authorization bypass in gRPC-Go where malformed HTTP/2 ':path' pseudo-headers lacking a leading slash could bypass security policies. CVE-2026-34986 resolves a denial of service in the Go JOSE library where decrypting a malformed JSON Web Encryption object with an empty encrypted key field caused application failure. The update properly validates inputs to prevent these issues. No breaking changes or new features are introduced. The advisory includes a known non-security issue with filesystem metrics after upgrading Collector versions. The vendor provides an official fix in this release.
Potential Impact
Successful exploitation of these vulnerabilities could lead to denial of service conditions by causing infinite loops or application crashes, resulting in service unavailability. The authorization bypass vulnerability could allow remote attackers to circumvent security policies and gain unauthorized access or disclose information. These impacts affect the availability and confidentiality of services using the affected libraries within the Red Hat OpenTelemetry build.
Mitigation Recommendations
An official fix is available in Red Hat build of OpenTelemetry 3.9.2. Users should apply this update to remediate the denial of service vulnerabilities in the XPath and Go JOSE libraries and the authorization bypass in gRPC-Go. For upgrade instructions, refer to Red Hat's documentation on upgrading operators in OpenShift. No additional workarounds are provided. The vendor manages remediation through this updated release.
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release
Description
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * XPath library vulnerability is fixed: Previously, the 'github.com/antchfx/xpath' library was vulnerable to a denial of service (DoS) attack. This issue occurred because specially crafted boolean XPath expressions that evaluated to true caused an infinite loop in the 'logicalQuery.Select' function, leading to 100% CPU utilization. With this update, the XPath library properly handles these expressions and prevents infinite loops. As a result, the system is no longer vulnerable to this DoS condition. For more information, see https://access.redhat.com/security/cve/cve-2026-32287. * gRPC-Go authorization bypass vulnerability is fixed: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 ':path' pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed ':path' that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the ':path' pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186. * Go JOSE denial of service vulnerability is fixed: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial of service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986. Known issues: * The filesystem scraper does not produce the `system.filesystem.inodes.usage` and `system.filesystem.usage` metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This security advisory for Red Hat build of OpenTelemetry 3.9.2 fixes three vulnerabilities: CVE-2026-32287 addresses a denial of service in the 'github.com/antchfx/xpath' library caused by specially crafted boolean XPath expressions leading to infinite loops and 100% CPU utilization. CVE-2026-33186 fixes an authorization bypass in gRPC-Go where malformed HTTP/2 ':path' pseudo-headers lacking a leading slash could bypass security policies. CVE-2026-34986 resolves a denial of service in the Go JOSE library where decrypting a malformed JSON Web Encryption object with an empty encrypted key field caused application failure. The update properly validates inputs to prevent these issues. No breaking changes or new features are introduced. The advisory includes a known non-security issue with filesystem metrics after upgrading Collector versions. The vendor provides an official fix in this release.
Potential Impact
Successful exploitation of these vulnerabilities could lead to denial of service conditions by causing infinite loops or application crashes, resulting in service unavailability. The authorization bypass vulnerability could allow remote attackers to circumvent security policies and gain unauthorized access or disclose information. These impacts affect the availability and confidentiality of services using the affected libraries within the Red Hat OpenTelemetry build.
Mitigation Recommendations
An official fix is available in Red Hat build of OpenTelemetry 3.9.2. Users should apply this update to remediate the denial of service vulnerabilities in the XPath and Go JOSE libraries and the authorization bypass in gRPC-Go. For upgrade instructions, refer to Red Hat's documentation on upgrading operators in OpenShift. No additional workarounds are provided. The vendor manages remediation through this updated release.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:9388
- Cve Count
- 3
- Additional Cves
- ["CVE-2026-33186","CVE-2026-34986"]
- Cvss Version
- null
Threat ID: 6a160952e29bf47b50618c91
Added to database: 05/26/2026, 20:57:54 UTC
Last enriched: 07/26/2026, 00:41:07 UTC
Last updated: 07/31/2026, 21:28:42 UTC
Views: 41
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.