Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
OpenTelemetry Collector may crash or be spoofed
published 3 days ago
Summary
The OpenTelemetry Collector package for AlmaLinux can be forced to stop working or be tricked into accepting false certificates. This happens because certain network and security components can be overwhelmed or misled. Install the latest security update for the collector as soon as possible to prevent these issues.
What to do
- Update almalinux opentelemetry-collector to version 0.158.0-2.el9_8.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| AlmaLinux:9 | almalinux | opentelemetry-collector |
< 0.158.0-2.el9_8 Fix: upgrade to 0.158.0-2.el9_8
|
Original advisory text
Important: opentelemetry-collector security update
Collector with the supported components for a Red Hat build of OpenTelemetry
Security Fix(es):
* net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
* net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Security Fix(es):
* net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667)
* crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031)
* net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
* net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
- https://access.redhat.com/errata/RHSA-2026:93617 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2026-111943 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-78667 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-78669 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-94440 Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2026-97031 Third Party Advisory
- https://bugzilla.redhat.com/2548334 Third Party Advisory
- https://bugzilla.redhat.com/2548336 Third Party Advisory
- https://bugzilla.redhat.com/2548341 Third Party Advisory
- https://bugzilla.redhat.com/2548344 Third Party Advisory
- https://bugzilla.redhat.com/2556068 Third Party Advisory
- https://errata.almalinux.org/9/ALSA-2026-93617.html Vendor Advisory
Timeline
Published2 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
ALSA-2026:93617 · OSV
Track software like this
Free during beta