The Red Hat OpenShift distributed tracing platform (Tempo) 3.5.1 release addresses security vulnerabilities including CVE-2025-2786 and CVE-2025-22868. CVE-2025-22868 is a flaw in the golang.org/x/oauth2/jws package where token parsing uses strings.Split on JWT tokens, allowing an attacker to craft tokens with excessive '.' characters to cause high memory consumption and denial of service. The update introduces a requirement for users to have permissions to create TokenReview and SubjectAccessReview resources when creating or modifying TempoStack or TempoMonolithic custom resources with multi-tenancy enabled. Known issues include the need for the gateway component's ServiceAccount to have these permissions when tenancy mode is enabled, with a recommended workaround to deploy in a dedicated namespace and audit user permissions carefully. The release is based on Grafana Tempo 2.7.1 and includes fixes for other CVEs as well.

The vulnerabilities fixed in this release can lead to denial of service conditions due to memory exhaustion when processing maliciously crafted tokens (CVE-2025-22868). The permission changes affect the ability to create or modify multi-tenant Tempo custom resources, potentially impacting operational workflows if permissions are not properly configured. No known exploits are reported in the wild. The overall impact is high due to the denial of service potential and required permission changes for multi-tenancy management.

A fix is available in Red Hat OpenShift distributed tracing platform (Tempo) version 3.5.1. Users should upgrade to this version to address the vulnerabilities. For tenancy mode authorization issues, deploy the Tempo instance in a dedicated namespace and carefully audit user permissions to Secrets. Additionally, pre-validate JWT tokens to ensure they do not contain excessive '.' characters before processing to mitigate CVE-2025-22868. Follow Red Hat's official upgrade documentation for applying this update.