This Red Hat security update addresses multiple vulnerabilities in the opentelemetry-collector, including denial of service via uncontrolled memory allocation in Prometheus (CVE-2026-42154, CVSS 7.5), information disclosure of Azure OAuth secrets (CVE-2026-42151, CVSS 7.5), and several Go language vulnerabilities. Affected Prometheus versions are below 3.5.3 or between 3.6.0 and 3.11.3, while affected Go versions are below 1.25.10 or between 1.26.0 and 1.26.3. The advisory provides a patch for Red Hat Enterprise Linux 10 systems, requiring users to apply the update as detailed in the referenced solution article.
Red Hat Product Errata RHSA-2026:34357 - Security Advisory Issued: 2026-07-01 Updated: 2026-07-01 RHSA-2026:34357 - Security Advisory Overview Updated Packages Synopsis Important: opentelemetry-collector security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for opentelemetry-collector is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154) github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151) net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681) crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 10 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 x86_64 Red Hat Enterprise Linux for IBM z Systems 10 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 s390x Red Hat Enterprise Linux for Power, little endian 10 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 ppc64le Red Hat Enterprise Linux for ARM 64 10 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 s390x Fixes BZ - 2466505 - CVE-2026-42154 github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint BZ - 2466507 - CVE-2026-42151 github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API BZ - 2467822 - CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME BZ - 2480756 - CVE-2026-39821 golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing BZ - 2480761 - CVE-2026-25681 golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting BZ - 2484207 - CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries CVEs CVE-2026-25681 CVE-2026-27145 CVE-2026-33811 CVE-2026-39821 CVE-2026-42151 CVE-2026-42154 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 10 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 x86_64 opentelemetry-collector-0.152.1-1.el10_2.x86_64.rpm SHA-256: d15d541b8711a41478544f7f927650ca3138977df93a99a91aa69aac71e891a3 Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 x86_64 opentelemetry-collector-0.152.1-1.el10_2.x86_64.rpm SHA-256: d15d541b8711a41478544f7f927650ca3138977df93a99a91aa69aac71e891a3 Red Hat Enterprise Linux for IBM z Systems 10 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 s390x opentelemetry-collector-0.152.1-1.el10_2.s390x.rpm SHA-256: bf074797f09a2f7f3fd64fda3a786bdcfc2fe593c40d7c43b98c847b877a8c26 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 s390x opentelemetry-collector-0.152.1-1.el10_2.s390x.rpm SHA-256: bf074797f09a2f7f3fd64fda3a786bdcfc2fe593c40d7c43b98c847b877a8c26 Red Hat Enterprise Linux for Power, little endian 10 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 ppc64le opentelemetry-collector-0.152.1-1.el10_2.ppc64le.rpm SHA-256: fc3aa5da1cd042a654c24fcb1ca58c21b15e2975582526c3d4dc9ac91b29504c Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 ppc64le opentelemetry-collector-0.152.1-1.el10_2.ppc64le.rpm SHA-256: fc3aa5da1cd042a654c24fcb1ca58c21b15e2975582526c3d4dc9ac91b29504c Red Hat Enterprise Linux for ARM 64 10 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 aarch64 opentelemetry-collector-0.152.1-1.el10_2.aarch64.rpm SHA-256: 22ea74cba920d08024a2bee1098760eb65e1b51714cbacfd23cf38e6c3375f0a Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 aarch64 opentelemetry-collector-0.152.1-1.el10_2.aarch64.rpm SHA-256: 22ea74cba920d08024a2bee1098760eb65e1b51714cbacfd23cf38e6c3375f0a Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 aarch64 opentelemetry-collector-0.152.1-1.el10_2.aarch64.rpm SHA-256: 22ea74cba920d08024a2bee1098760eb65e1b51714cbacfd23cf38e6c3375f0a Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 s390x opentelemetry-collector-0.152.1-1.el10_2.s390x.rpm SHA-256: bf074797f09a2f7f3fd64fda3a786bdcfc2fe593c40d7c43b98c847b877a8c26 Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 ppc64le opentelemetry-collector-0.152.1-1.el10_2.ppc64le.rpm SHA-256: fc3aa5da1cd042a654c24fcb1ca58c21b15e2975582526c3d4dc9ac91b29504c Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 x86_64 opentelemetry-collector-0.152.1-1.el10_2.x86_64.rpm SHA-256: d15d541b8711a41478544f7f927650ca3138977df93a99a91aa69aac71e891a3 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 x86_64 opentelemetry-collector-0.152.1-1.el10_2.x86_64.rpm SHA-256: d15d541b8711a41478544f7f927650ca3138977df93a99a91aa69aac71e891a3 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 aarch64 opentelemetry-collector-0.152.1-1.el10_2.aarch64.rpm SHA-256: 22ea74cba920d08024a2bee1098760eb65e1b51714cbacfd23cf38e6c3375f0a Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 ppc64le opentelemetry-collector-0.152.1-1.el10_2.ppc64le.rpm SHA-256: fc3aa5da1cd042a654c24fcb1ca58c21b15e2975582526c3d4dc9ac91b29504c Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 10.2 SRPM opentelemetry-collector-0.152.1-1.el10_2.src.rpm SHA-256: 79ee7ec5e5cf95e0a7be413e62beeb195519a95f4b7d367d07d611092d6d0f90 s390x opentelemetry-collector-0.152.1-1.el10_2.s390x.rpm SHA-256: bf074797f09a2f7f3fd64fda3a786bdcfc2fe593c40d7c43b98c847b877a8c26 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .