[ALSA-2026:93596] Important: opentelemetry-collector security update
Type:
security
Severity:
important
Release date:
2026-11-04
Description:
Collector with the supported components for a Red Hat build of OpenTelemetry Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 opentelemetry-collector-0.158.0-2.el10_2.aarch64.rpm f08f4e74d413b795dc328686b101c80a9bd673b57130019493ec94ac05267486
ppc64le opentelemetry-collector-0.158.0-2.el10_2.ppc64le.rpm 431092a583a7d44b133bbdd2429275ed0789f872b212a376c0aa9c17f2c0b0be
s390x opentelemetry-collector-0.158.0-2.el10_2.s390x.rpm b904675deb4dcd034c1a4af7bd2615e48f895dab1804494d4b08336104e56e74
x86_64 opentelemetry-collector-0.158.0-2.el10_2.x86_64.rpm f38c40fcb3abcee03f2ccc8b7a1625d9f03e3efeb7beaf99ca9154511667cb30
x86_64_v2 opentelemetry-collector-0.158.0-2.el10_2.x86_64_v2.rpm 5a4c674affb0986ba4f065601469f1f08db6c61317f8ab5003d166cc335811a0
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.