RHSA-2026:53415: Important: opentelemetry

Synopsis Important: opentelemetry-collector security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): - github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) - github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) - apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities (CVE-2026-43870) - net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) - golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) - golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136) - golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) - crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Affected Products - Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 x86_64 - Red Hat Enterprise Linux Server - AUS 9.6 x86_64 - Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 s390x - Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 ppc64le - Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 aarch64 - Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 ppc64le - Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 x86_64 - Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 aarch64 - Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 s390x - Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 x86_64 - Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 aarch64 - Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 ppc64le - Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 s390x Fixes - BZ - 2466505 - CVE-2026-42154 github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint - BZ - 2466507 - CVE-2026-42151 github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API - BZ - 2466671 - CVE-2026-43870 apache-thrift: Apache Thrift: Denial of Service via multiple vulnerabilities - BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME - BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing - BZ - 2480757 - CVE-2026-27136 golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass - BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting - BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | x86_64 | | opentelemetry-collector-0.152.1-1.el9_6.x86_64.rpm | SHA-256: bdc5241053b6bee0f9be1e7bf629edf499c4f26f1cffd5adf7fc57225d17ecac | Red Hat Enterprise Linux Server - AUS 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | x86_64 | | opentelemetry-collector-0.152.1-1.el9_6.x86_64.rpm | SHA-256: bdc5241053b6bee0f9be1e7bf629edf499c4f26f1cffd5adf7fc57225d17ecac | Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | s390x | | opentelemetry-collector-0.152.1-1.el9_6.s390x.rpm | SHA-256: 35a1d5136cbf235d96f68a8129fe91891dd56429cb460460dbb899c6c049805f | Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | ppc64le | | opentelemetry-collector-0.152.1-1.el9_6.ppc64le.rpm | SHA-256: 540a7d9f6d95314ea5da44413c239cc1dc96f0a12a6b8d45b482b6ba543d75d0 | Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | aarch64 | | opentelemetry-collector-0.152.1-1.el9_6.aarch64.rpm | SHA-256: 8bba288276d84919d7494acfb5225d52eff470545a8bab3632d5afde5077cdae | Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | ppc64le | | opentelemetry-collector-0.152.1-1.el9_6.ppc64le.rpm | SHA-256: 540a7d9f6d95314ea5da44413c239cc1dc96f0a12a6b8d45b482b6ba543d75d0 | Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | x86_64 | | opentelemetry-collector-0.152.1-1.el9_6.x86_64.rpm | SHA-256: bdc5241053b6bee0f9be1e7bf629edf499c4f26f1cffd5adf7fc57225d17ecac | Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | aarch64 | | opentelemetry-collector-0.152.1-1.el9_6.aarch64.rpm | SHA-256: 8bba288276d84919d7494acfb5225d52eff470545a8bab3632d5afde5077cdae | Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | s390x | | opentelemetry-collector-0.152.1-1.el9_6.s390x.rpm | SHA-256: 35a1d5136cbf235d96f68a8129fe91891dd56429cb460460dbb899c6c049805f | Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | x86_64 | | opentelemetry-collector-0.152.1-1.el9_6.x86_64.rpm | SHA-256: bdc5241053b6bee0f9be1e7bf629edf499c4f26f1cffd5adf7fc57225d17ecac | Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | aarch64 | | opentelemetry-collector-0.152.1-1.el9_6.aarch64.rpm | SHA-256: 8bba288276d84919d7494acfb5225d52eff470545a8bab3632d5afde5077cdae | Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | ppc64le | | opentelemetry-collector-0.152.1-1.el9_6.ppc64le.rpm | SHA-256: 540a7d9f6d95314ea5da44413c239cc1dc96f0a12a6b8d45b482b6ba543d75d0 | Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.6 | SRPM | | opentelemetry-collector-0.152.1-1.el9_6.src.rpm | SHA-256: 47f1927b7a8d00fac08b8c025a23d550be665f063249637237f710ad6cde69ea | | s390x | | opentelemetry-collector-0.152.1-1.el9_6.s390x.rpm | SHA-256: 35a1d5136cbf235d96f68a8129fe91891dd56429cb460460dbb899c6c049805f |