The Red Hat Service Telemetry Framework (STF) 1.5.7 release addresses multiple vulnerabilities: CVE-2026-23490 and CVE-2026-30922 involve denial of service through memory exhaustion and unbounded recursion in the pyasn1 library; CVE-2026-24049 allows privilege escalation or arbitrary code execution via malicious wheel file unpacking; CVE-2026-25679 concerns incorrect parsing of IPv6 host literals in net/url; CVE-2026-32280 is a denial of service vulnerability in certificate chain building; and CVE-2025-61729 involves excessive resource consumption when printing error strings during host certificate validation in crypto/x509. These vulnerabilities affect the STF container images used in Red Hat OpenStack and OpenShift environments. Red Hat has released updated container images to remediate these issues.

Successful exploitation of these vulnerabilities could lead to denial of service conditions through resource exhaustion or unbounded recursion, privilege escalation or arbitrary code execution via malicious package unpacking, and potential disruption or incorrect behavior in network address parsing and certificate validation processes. These impacts could affect the reliability and security of telemetry data collection and transmission within affected Red Hat environments.

Red Hat has released updated Service Telemetry Framework container images (version 1.5.7) that address these vulnerabilities. Users should update their STF deployments by pulling the new container images from the Red Hat Container Registry as specified in the advisory. Dockerfiles and deployment scripts should be updated to reference these fixed images or the latest available images. No additional mitigation steps are indicated by the vendor advisory.