Loading story…
Red Hat released updated OpenTelemetry Collector packages for RHEL 9 and RHEL 10 to remediate denial-of-service and memory-exhaustion vulnerabilities in bundled Go dependencies. The updates address CVE-2025-27144 in Go JOSE parsing, CVE-2025-22868, CVE-2025-29786, and CVE-2025-30204; the RHEL 9 advisory also covers CVE-2024-45336, which could expose sensitive HTTP headers through a cross-domain redirect. Fixed packages are opentelemetry-collector-0.107.0-8.el9_6 for RHEL 9 and opentelemetry-collector-0.107.0-9.el10_0 for RHEL 10, across x86_64, s390x, ppc64le, and aarch64 systems.
The same vulnerable dependencies affected Red Hat OpenShift products. OpenShift Container Platform 4.17.22 fixes the Go JOSE parsing DoS issue, while Logging for OpenShift 5.9.13 addresses denial-of-service and local-file-inclusion flaws in Net::IMAP, Rack::Static, Go JOSE, and golang-jwt/jwt. Red Hat also shipped updated OpenShift Container Platform 4.14.51 and OpenShift Data Foundation images, including fixes for CVE-2025-30204; administrators should apply the relevant RHEL package, OpenShift release, logging-stack, and container-image updates through supported channels.
See affected versions and whether adversaries are exploiting it.
14 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Important advisory RHSA-2025:8299 for OpenShift Container Platform 4.15.52. The update remediated CVE-2025-22868, a golang.org/x/oauth2/jws token-parsing flaw that can cause unexpected memory consumption, along with product bug fixes.
Red Hat issued Moderate advisory RHSA-2025:4712 for OpenShift Container Platform 4.18.13, updating packages and container images across supported architectures. The release remediated CVE-2025-27144, a Go JOSE parsing denial-of-service vulnerability, and included operational fixes such as correcting oc-mirror error handling and DHCP CNI overflow.
Red Hat issued Important advisory RHSA-2025:7479 for opentelemetry-collector on RHEL 10, releasing version 0.107.0-9.el10_0. The update addressed CVE-2025-27144, CVE-2025-22868, CVE-2025-29786, and CVE-2025-30204.
Red Hat issued Important advisory RHSA-2025:7407 for the Red Hat build of OpenTelemetry Collector on RHEL 9, providing fixed version 0.107.0-8.el9_6. It remediated Go JOSE, OAuth2/JWS, Expr parser, and jwt-go denial-of-service or memory-exhaustion vulnerabilities.
Red Hat issued Important advisory RHSA-2025:4511 with updated RHODF-4.18-RHEL-9 container images. The update remediated flaws in Express, npm-serialize-javascript, http-proxy-middleware, Go JOSE, OAuth2/JWS, Go SSH, and jwt-go.
Red Hat issued Important advisory RHSA-2025:4177 for OpenShift Container Platform 4.14.51. The release addressed excessive JWT-header memory allocation, a Helm YAML-content panic, a Linux USB-audio out-of-bounds read, and cross-namespace secret exposure through the Bare Metal Operator BMCEventSubscription CRD.
Red Hat issued Important advisory RHSA-2025:3906 for Logging for Red Hat OpenShift 5.9.13. Updated logging images remediated Net::IMAP memory-exhaustion DoS, Rack::Static local file inclusion, and Go JOSE and jwt-go parsing issues.
Red Hat issued Important advisory RHSA-2025:3335 for opentelemetry-collector on RHEL 9, supplying version 0.107.0-8.el9_5. The update addressed a Go net/http cross-domain redirect header-disclosure issue and DoS or memory-exhaustion flaws in go-jose, oauth2/jws, and Expr.
Red Hat issued Moderate advisory RHSA-2025:3061 for OpenShift Container Platform 4.17.22, remediating CVE-2025-27144, a denial-of-service vulnerability in Go JOSE parsing.
Red Hat issued Important advisory RHSA-2025:2652 with updated ODF 4.18.0 RHEL 9 images. It fixed vulnerabilities including node-gettext prototype pollution, cross-spawn ReDoS, an SSH authorization-bypass condition, and a Kubernetes kubelet node DoS issue.
Red Hat issued RHSA-2025:0892, an Important advisory releasing OpenShift Dev Spaces 3.18.0. The update remediated vulnerabilities in cross-spawn, PostCSS, golang.org/x/crypto, golang.org/x/net, DOMPurify, and nanoid.
Red Hat reported Bug 2319884 for CVE-2024-21536, a denial-of-service flaw in http-proxy-middleware in which requests to certain paths can trigger an unhandled promise rejection and crash a Node.js server.
Red Hat addressed CVE-2024-45336, in which Go's HTTP client could restore sensitive headers after a cross-domain redirect followed by a same-domain redirect. Fixes were issued across affected RHEL, OpenShift Service Mesh, Advanced Cluster Management, Satellite Client, RHOL, and Kubernetes-management products through multiple RHSA advisories.
Red Hat addressed CVE-2025-29786, an Expr parser memory-exhaustion denial-of-service flaw, for Red Hat Enterprise Linux 9.4 Extended Update Support through RHSA-2025:3593. Expr 1.17.0 added AST-node and parsing-memory limits to prevent unbounded expressions from exhausting process memory.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
16 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `opentelemetry-collector` across multiple Red Hat Enterprise Linux 9 and 10 channels, including RHEL 9.4, 9.6, 10.0, and 10.2, along with SAP, EUS, Extended Life Cycle, and 4-year support streams. The updates ship `opentelemetry-collector` version `0.152.1` in platform-specific builds and affect x86_64, aarch64, ppc64le, and s390x systems. The advisories remediate multiple bundled-component vulnerabilities in **Prometheus**, **Apache Thrift**, and Go libraries, including `CVE-2026-42154`, `CVE-2026-42151`, `CVE-2026-43870`, `CVE-2026-33811`, `CVE-2026-39821`, `CVE-2026-27136`, `CVE-2026-25681`, and `CVE-2026-27145`. Red Hat said the flaws could lead to denial of service, information disclosure including exposure of an Azure OAuth client secret, privilege escalation through Punycode label processing, cross-site scripting conditions in `golang.org/x/net/html`, and arbitrary code execution in affected deployments.
Aug 20, 2026
Red Hat released fixes for three Go standard-library denial-of-service vulnerabilities: **CVE-2024-34155** in `go/parser`, **CVE-2024-34156** in `encoding/gob`, and **CVE-2024-34158** in `go/build/constraint`. Applications that parse or decode attacker-controlled input can panic after deeply nested Go literals, gob structures, or legacy `// +build` expressions exhaust stack space. Red Hat rated the issues Important in affected product advisories; no exploitation evidence is identified in the supplied advisories. The fixes were delivered through updated Go toolsets for RHEL 8 and RHEL 9 and propagated to container tooling including Podman, Buildah, CRI-O, and the RHEL 8 container-tools module. Red Hat also issued updated images and packages for OpenShift Container Platform 4.12 through 4.17, OpenShift API for Data Protection, OpenStack Platform, Migration Toolkit for Containers, and several OpenShift operators. Organizations should update affected systems, container tools, and OpenShift clusters through their applicable Red Hat release channels, including all supported x86_64, ARM64, IBM Power, and IBM Z/LinuxONE deployments.
Aug 27, 2026
Red Hat issued security updates across OpenShift Container Platform (OCP), OpenShift API for Data Protection (OADP), Migration Toolkit for Containers, OpenShift Logging, and OpenShift Virtualization to remediate denial-of-service, memory-consumption, argument-injection, information-disclosure, and authorization-bypass risks. A recurring issue is `CVE-2024-45338` in `golang.org/x/net/html`, whose non-linear parsing behavior can enable denial of service; it was addressed in OCP 4.17.16, OADP 1.3.7, OpenShift Logging 6.0.6, OpenShift Virtualization 4.16.7, and MTC 1.8.7. OCP 4.16.23 and 4.17.3 also fixed `CVE-2024-24786`, in which malformed JSON can cause an infinite loop in `golang-protobuf` processing. OADP 1.4.5 additionally remediates Go-library flaws that could permit authorization bypass, HTTP request smuggling, memory-exhaustion denial of service, SSH key-exchange denial of service, and go-git argument injection. The go-git issue, `CVE-2025-21613`, affects versions before 5.13.0 when the file transport shells out to Git binaries and can allow attacker-controlled `git-upload-pack` flags. Red Hat directs affected administrators to apply prerequisite errata and upgrade through the appropriate OpenShift release channel or product-specific update procedures across supported RHEL 8 and RHEL 9 architectures.
Aug 27, 2026