Red Hat released a security update for Red Hat Advanced Cluster Management for Kubernetes version 2.16.6. This update includes security fixes, bug fixes, and updated container images addressing multiple vulnerabilities. The advisory references several CVEs but does not detail individual flaw impacts. The update is rated as important by Red Hat Product Security.

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.16.6 security update

A vulnerability in Apache Thrift's handling of highly compressed data can lead to a denial of service (DoS) by causing resource exhaustion. Remote attackers can exploit this flaw by sending specially crafted compressed data to services using vulnerable Thrift bindings in Red Hat products, disrupting service availability. This issue is tracked as CVE-2026-48586 and affects Red Hat AI Base Images 3.5.1 (Neuron).

Red Hat Security Advisory: Red Hat AI Base Images 3.5.1 (Neuron)

A vulnerability in Apache Thrift affects Red Hat AI Base Images 3.3.3 (CUDA), allowing remote attackers to cause a denial of service by sending specially crafted highly compressed data. This improper handling of data amplification leads to resource exhaustion and service disruption. The issue impacts Red Hat products utilizing vulnerable Thrift bindings, including Red Hat OpenShift AI. No fix is currently available for this vulnerability.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (CUDA)

A vulnerability in Apache Thrift's handling of highly compressed data can lead to a denial of service (DoS) by causing resource exhaustion. This flaw affects Red Hat AI Base Images 3.3.3 (Spyre) used in Red Hat OpenShift AI. Remote attackers can exploit this by sending specially crafted compressed data, resulting in system unavailability. No fix has been released yet for this vulnerability.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (Spyre)

A vulnerability in Apache Thrift used by Red Hat AI Base Images 3.3.3 (CPU) allows remote attackers to cause a denial of service by sending specially crafted highly compressed data. This improper handling of data amplification leads to resource exhaustion and service disruption. No fix is currently available for this issue in the affected Red Hat AI Base Images. The vulnerability is rated as important and has a high impact on availability.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (CPU)

A vulnerability in Apache Thrift's handling of highly compressed data allows remote attackers to cause a denial of service (DoS) by sending specially crafted compressed data. This leads to resource exhaustion and system unavailability in Red Hat AI Base Images 3.3.3 (TPU) used in Red Hat OpenShift AI. The issue is categorized as improper handling of highly compressed data (data amplification). No fix has been released yet.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (TPU)

A vulnerability in Apache Thrift used by Red Hat AI Base Images 3.3.3 (CUDA 13.0) allows remote attackers to cause a denial of service by sending specially crafted, highly compressed data. This improper handling of data amplification leads to resource exhaustion and service disruption. The issue affects Red Hat OpenShift AI products. No fix is currently available as per the vendor advisory.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (CUDA 13.0)

A vulnerability in Apache Thrift used in Red Hat AI Base Images 3.3.3 (ROCm 7.0) allows remote attackers to cause a denial of service by sending specially crafted highly compressed data. This improper handling of data expansion leads to resource exhaustion and service disruption. The flaw affects services utilizing vulnerable Thrift bindings in Red Hat products. No fix has been released yet, and Red Hat is still investigating and analyzing affected products.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (ROCm 7.0)

A vulnerability in Apache Thrift used by Red Hat AI Base Images 3.3.3 (ROCm 6.4) allows remote attackers to cause a denial of service by sending specially crafted highly compressed data. This improper handling of data amplification leads to resource exhaustion and service disruption. The issue affects services utilizing vulnerable Thrift bindings in Red Hat products. No fix is currently available for this vulnerability.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (ROCm 6.4)

A vulnerability in Apache Thrift used by Red Hat AI Base Images 3.3.3 (Neuron) allows remote attackers to cause a denial of service by sending specially crafted highly compressed data. This improper handling of data amplification leads to resource exhaustion and service disruption. The issue affects Red Hat OpenShift AI and related products using vulnerable Thrift bindings. No fix is currently available as per the vendor advisory.

Red Hat Security Advisory: Red Hat AI Base Images 3.3.3 (Neuron)

Red Hat has released version 3.11.0 of its build of OpenTelemetry, which includes new features, security improvements, and bug fixes. This update removes the add_metric_suffixes field from the Prometheus Exporter configuration and introduces several technology preview features such as the OBI eBPF Receiver, Redaction Processor, Headers Setter Extension, and Kubernetes Leader Elector Extension. It also adds high availability support for Operator webhooks and fixes issues related to Instrumentation CR status updates and RBAC permissions for PersistentVolume resources.

Red Hat Security Advisory: Red Hat build of OpenTelemetry 3.11.0 release

Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.

This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:

https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html-single/release_notes/index#acm-release-notes

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

This update includes the following RPMs:

tempo2.10:
  * tempo2.10-2.10.7-0.2.hum1 (aarch64, x86_64)
  * tempo2.10-2.10.7-0.2.hum1.src (src)

Security Fix(es):

tempo2.10:
  * CVE-2026-48586
  * CVE-2026-55969

This update includes the following RPMs:

jaeger:
  * jaeger-2.20.0-0.5.hum1 (aarch64, x86_64)
  * jaeger-2.20.0-0.5.hum1.src (src)

Security Fix(es):

jaeger:
  * CVE-2026-48586
  * CVE-2026-55969

libthrift-java

thrift

This update includes the following RPMs:

opentelemetry-collector:
  * opentelemetry-collector-0.157.0-0.1.hum1 (aarch64, x86_64)
  * opentelemetry-collector-0.157.0-0.1.hum1.src (src)

Security Fix(es):

opentelemetry-collector:
  * CVE-2026-56852

org.apache.thrift:libthrift

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings.

This issue affects Apache Thrift: before 0.24.0.

Users are recommended to upgrade to version 0.24.0, which fixes the issue.

CVE-2026-48586: CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) in Apache Software Foundation Apache Thrift

CVE-2026-48586 is a vulnerability in Apache Thrift affecting Red Hat Hardened Images RPMs. It involves improper handling of highly compressed data, allowing remote attackers to cause a denial of service (DoS) by sending specially crafted compressed data that leads to resource exhaustion. Red Hat has released updated RPM packages to address this issue.

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

A denial of service vulnerability exists in the golang.org/x/text library's norm.Iter component used by Red Hat Hardened Images RPMs, including opentelemetry-collector. The flaw causes an infinite loop when processing specially crafted invalid UTF-8 input, making affected applications unresponsive. This issue is tracked as CVE-2026-56852 and affects opentelemetry-collector version 0.157.0-0.1.hum1. No fix is currently available that meets Red Hat's criteria for deployment. The vulnerability has a high severity rating due to its potential to cause denial of service.

A security advisory from Red Hat addresses vulnerabilities in Red Hat Hardened Images RPMs, specifically involving the opentelemetry-collector-contrib package version 0.157.0-0.1.hum1. One notable flaw (CVE-2026-56852) in the golang.org/x/text library's norm.Iter component can cause an infinite loop when processing invalid UTF-8 input, leading to a denial of service (DoS). This update includes bug fixes and enhancements but does not explicitly state a fix for these CVEs within the advisory. The vulnerabilities are rated as high severity by Red Hat.

Search: CVE-2026-48586