RLSA-2026:93617: Important: opentelemetry-collector security update
Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry
Security Fix(es):
net/http: golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/opentelemetry-collectorto a version that resolves this vulnerability.Fixed in 0:0.158.0-2.el9_8
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which attack paths are addressed by this update?
The update addresses denial-of-service conditions involving crafted HTTP Range headers, multiple ECH outer extension references, multipart form parsing memory-limit bypasses, and excessive HTTP/2 SETTINGS frames. It also addresses a man-in-the-middle risk involving untrusted intermediate certificates.
Does exploiting these issues require authentication or user interaction?
The supplied severity vector indicates network reachability, low attack complexity, no required privileges, and no user interaction. This means remotely reachable collector-related endpoints should be prioritized for patching.
What is the primary operational impact indicated for the denial-of-service issues?
The supplied CVSS vector indicates high availability impact, with no confidentiality or integrity impact. Successful exploitation may disrupt service availability.