RHSA-2026:93617: Important: opentelemetry-collector security update
Collector with the supported components for a Red Hat build of OpenTelemetrySecurity Fix(es): net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/opentelemetry-collectorto a version that resolves this vulnerability.Fixed in 0.158.0-2.el9_8 - Upgrade
Upgrade
redhat/opentelemetry-collectorto a version that resolves this vulnerability.Fixed in 0.158.0-2.el9_8.aa
Event History
Frequently Asked Questions
Which parts of the collector's network-facing behavior are implicated by these fixes?
The advisory lists denial-of-service issues in HTTP Range-header handling, multipart form parsing, HTTP/2 SETTINGS processing, and TLS ECH extension handling. It also lists a certificate-validation issue in crypto/x509 that could enable man-in-the-middle attacks involving untrusted intermediate certificates.
What attacker interaction is indicated for the denial-of-service issues?
The affected behaviors are triggered through crafted HTTP Range headers, multipart form parsing, excessive HTTP/2 SETTINGS frames, or multiple ECH outer extension references. This indicates an attacker needs to be able to send relevant HTTP or TLS traffic to an affected component.
Does the advisory state whether default collector deployments are affected?
No. The provided advisory text identifies the included components and fixes but does not state which collector configurations expose the affected code paths by default.
How can I determine whether a deployed collector is affected?
Compare the installed collector package and its included supported components against the updates provided by RHSA-2026:93617. The supplied information does not include affected or fixed package version numbers, so version-specific verification requires the referenced advisory or CVE information.