Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Rust bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Buffer Over-read vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings.
This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0.
Users are recommended to upgrade to version 0.24.0, which fixes the issue.
This update includes the following RPMs:
opentelemetry-collector:
* opentelemetry-collector-0.157.0-0.1.hum1 (aarch64, x86_64)
* opentelemetry-collector-0.157.0-0.1.hum1.src (src)
Security Fix(es):
opentelemetry-collector:
* CVE-2026-56852
OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all data before marking the namespace as deleted. This can affect any outstanding leases as well as potentially leaving unrelated storage entries around. This vulnerability is fixed in 2.5.3.
OpenBao is an open source identity-based secrets management system that uses namespaces for multi-tenant separation. Prior to version 2.5.3, a vulnerability allowed a privileged administrator in one tenant to renew or revoke tokens belonging to another tenant if token accessors were leaked. This cross-namespace token renewal and revocation issue is fixed in version 2.5.3.
OpenBao versions prior to 2.5.3 contain a vulnerability in the PostgreSQL database secrets engine where improper quoting of schema names during role privilege revocation can lead to SQL injection. This flaw may cause role revocation failures or, in rare cases, allow SQL injection as the management user. The vulnerability originates from HashiCorp Vault and is fixed in OpenBao version 2.5.3. A recommended workaround is to audit database schemas and restrict users from creating new schemas or granting privileges on them.
OpenBao versions prior to 2.5.3 contain a vulnerability in the OCI plugin downloader where a decompression bomb can cause a denial of service by exhausting disk space. The vulnerability arises because the plugin extraction function streams decompressed tar data without an upper bound on bytes written before verifying integrity. An attacker controlling the OCI registry can serve a crafted image that decompresses to an arbitrarily large file, causing disk exhaustion before the SHA256 hash check detects tampering. This issue is fixed in version 2.5.3.
OpenBao versions prior to 2.5.3 have a vulnerability in the Certificate authentication method that allows token renewal using a different certificate signed by the same CA when disable_binding=true is set. This flaw permits attackers with knowledge of the original token or its accessor to extend the lifetime of dynamic leases by renewing tokens with sibling certificates, even if those certificates do not match the original role or certificate. The issue is fixed in version 2.5.3.
OpenBao versions prior to 2.5.2 with OIDC/JWT authentication enabled and roles configured with callback_mode=direct are vulnerable to reflected cross-site scripting (XSS) via the error_description parameter on failed authentication pages. This vulnerability allows attackers to access the authentication token used by the victim in the Web UI. The issue is fixed in version 2.5.2 by replacing the error_description parameter with a static error message. Mitigation includes removing roles with callback_mode set to direct.
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the `direct` mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for `direct` type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with `callback_mode=direct` or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.
OpenBao versions prior to 2.4.4 contain a privilege escalation vulnerability where a privileged operator with access to the identity group subsystem can add a root policy to a group identity, thereby escalating permissions to root level. This occurs specifically when an operator in the root namespace has access to identity/groups endpoints but lacks direct policy access. The vulnerability has been patched in version 2.4.4.
OpenBao versions prior to 2.4.2 have an issue where audit logs do not properly redact []byte fields. This results in sensitive data such as base64-encoded raw system data and public keys used in signing operations being logged in cleartext. The vulnerability has been addressed in version 2.4.2.
OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC'd). This impacts those using the ACME functionality of PKI, resulting in short-lived ACME verification challenge codes being leaked in the audit logs. Additionally, this impacts those using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use. This issue has been patched in OpenBao 2.4.2.