Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * XPath library vulnerability is fixed: Previously, the 'github.com/antchfx/xpath' library was vulnerable to a denial of service (DoS) attack. This issue occurred because specially crafted boolean XPath expressions that evaluated to true caused an infinite loop in the 'logicalQuery.Select' function, leading to 100% CPU utilization. With this update, the XPath library properly handles these expressions and prevents infinite loops. As a result, the system is no longer vulnerable to this DoS condition. For more information, see https://access.redhat.com/security/cve/cve-2026-32287. * gRPC-Go authorization bypass vulnerability is fixed: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 ':path' pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed ':path' that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the ':path' pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186. * Go JOSE denial of service vulnerability is fixed: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial of service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986. Known issues: * The filesystem scraper does not produce the `system.filesystem.inodes.usage` and `system.filesystem.usage` metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
AI Analysis
Technical Summary
This Red Hat security advisory addresses several vulnerabilities in the Red Hat build of OpenTelemetry 3.9.2. The primary vulnerability (CVE-2026-32287) involves the 'github.com/antchfx/xpath' library, where specially crafted boolean XPath expressions that evaluate to true cause an infinite loop in the 'logicalQuery.Select' function, resulting in 100% CPU utilization and a denial of service condition. The update corrects this by properly handling such expressions to prevent infinite loops. Additional vulnerabilities fixed include an authorization bypass in gRPC-Go due to improper validation of the HTTP/2 ':path' pseudo-header, and a denial of service in the Go JOSE library caused by malformed JSON Web Encryption objects. The advisory confirms no breaking changes or deprecations and provides instructions for upgrading. The affected product is Red Hat OpenShift distributed tracing, specifically versions >=3.9.1 and <3.9.2. No exploits are currently known in the wild.
Potential Impact
The XPath library vulnerability allows an attacker to cause a denial of service by triggering an infinite loop that consumes 100% CPU, making the affected system unresponsive. The gRPC-Go vulnerability could allow attackers to bypass authorization controls by sending malformed HTTP/2 requests, potentially gaining unauthorized access or disclosing information. The Go JOSE vulnerability could cause application crashes when processing malformed encrypted JSON Web Encryption objects, leading to denial of service. These vulnerabilities impact system availability and security policy enforcement.
Mitigation Recommendations
A fix is available in Red Hat build of OpenTelemetry version 3.9.2. Users should upgrade affected versions (>=3.9.1 <3.9.2) to 3.9.2 or later to remediate these vulnerabilities. The vendor advisory provides detailed upgrade instructions. No additional mitigations or workarounds are noted. There are no breaking changes or deprecations in this update.
Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.9.2 release
Description
This release of the Red Hat build of OpenTelemetry provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * XPath library vulnerability is fixed: Previously, the 'github.com/antchfx/xpath' library was vulnerable to a denial of service (DoS) attack. This issue occurred because specially crafted boolean XPath expressions that evaluated to true caused an infinite loop in the 'logicalQuery.Select' function, leading to 100% CPU utilization. With this update, the XPath library properly handles these expressions and prevents infinite loops. As a result, the system is no longer vulnerable to this DoS condition. For more information, see https://access.redhat.com/security/cve/cve-2026-32287. * gRPC-Go authorization bypass vulnerability is fixed: Previously, gRPC-Go was vulnerable to an authorization bypass attack. This issue occurred because the HTTP/2 ':path' pseudo-header was not properly validated. Remote attackers could send raw HTTP/2 frames with a malformed ':path' that omitted the mandatory leading slash to bypass defined security policies. With this update, gRPC-Go properly validates the ':path' pseudo-header and rejects malformed requests. As a result, attackers can no longer bypass security policies to gain unauthorized access to services or disclose information. For more information, see https://access.redhat.com/security/cve/cve-2026-33186. * Go JOSE denial of service vulnerability is fixed: Previously, the Go JOSE library for handling JSON Web Encryption (JWE) objects was vulnerable to a denial of service (DoS) attack. This issue occurred because the application failed when decrypting a specially crafted JWE object that specified a key wrapping algorithm but contained an empty encrypted key field. With this update, Go JOSE properly validates the encrypted key field before decryption. As a result, the application no longer crashes when processing malformed JWE objects, and the service remains available to legitimate users. For more information, see https://access.redhat.com/security/cve/cve-2026-34986. Known issues: * The filesystem scraper does not produce the `system.filesystem.inodes.usage` and `system.filesystem.usage` metrics in the Host Metrics Receiver after upgrading from Collector version 0.142.0 to 0.143.0 or later. No known workaround exists. For more information, see https://issues.redhat.com/browse/TRACING-5963.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat security advisory addresses several vulnerabilities in the Red Hat build of OpenTelemetry 3.9.2. The primary vulnerability (CVE-2026-32287) involves the 'github.com/antchfx/xpath' library, where specially crafted boolean XPath expressions that evaluate to true cause an infinite loop in the 'logicalQuery.Select' function, resulting in 100% CPU utilization and a denial of service condition. The update corrects this by properly handling such expressions to prevent infinite loops. Additional vulnerabilities fixed include an authorization bypass in gRPC-Go due to improper validation of the HTTP/2 ':path' pseudo-header, and a denial of service in the Go JOSE library caused by malformed JSON Web Encryption objects. The advisory confirms no breaking changes or deprecations and provides instructions for upgrading. The affected product is Red Hat OpenShift distributed tracing, specifically versions >=3.9.1 and <3.9.2. No exploits are currently known in the wild.
Potential Impact
The XPath library vulnerability allows an attacker to cause a denial of service by triggering an infinite loop that consumes 100% CPU, making the affected system unresponsive. The gRPC-Go vulnerability could allow attackers to bypass authorization controls by sending malformed HTTP/2 requests, potentially gaining unauthorized access or disclosing information. The Go JOSE vulnerability could cause application crashes when processing malformed encrypted JSON Web Encryption objects, leading to denial of service. These vulnerabilities impact system availability and security policy enforcement.
Mitigation Recommendations
A fix is available in Red Hat build of OpenTelemetry version 3.9.2. Users should upgrade affected versions (>=3.9.1 <3.9.2) to 3.9.2 or later to remediate these vulnerabilities. The vendor advisory provides detailed upgrade instructions. No additional mitigations or workarounds are noted. There are no breaking changes or deprecations in this update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:9388
- Cve Count
- 3
- Additional Cves
- ["CVE-2026-33186","CVE-2026-34986"]
Threat ID: 6a160952e29bf47b50618c91
Added to database: 05/26/2026, 20:57:54 UTC
Last enriched: 08/17/2026, 17:05:44 UTC
Last updated: 09/15/2026, 01:45:37 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.