Threats Tagged 'cve-2026-39882'

The 1.5.2 release of COO.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.10. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:54768 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/

The prometheus-alertmanager package version 0.32.0-r0 addresses two security vulnerabilities, including CVE-2026-39882. A patch is available in this version to fix these issues. No CVSS score or detailed technical impact information is provided for CVE-2026-39882. There are no known exploits in the wild at this time.

CVE-2026-39882 is a medium severity vulnerability in the open-telemetry opentelemetry-go library versions prior to 1.43.0. The vulnerability arises because the OTLP HTTP exporters read the entire HTTP response body into memory without limiting its size, which can lead to memory exhaustion. This issue can be exploited if the collector endpoint is attacker-controlled or if a network attacker can intercept and manipulate the connection. The vulnerability has been fixed in version 1.43.0.